Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Patched.24562.10289.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.Patched.24562.10289.exe
Analysis ID:1505139
MD5:d430fb367b17fdd8a5f7fd72c16e0477
SHA1:bd832259a3dd2e8d0c4e421bdf92c0a7b06f9049
SHA256:3710df97f996f8f6390fa8b23bbafea03f2e7568bf00297f737324f380f06675
Tags:exe
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Generic Python Ransomware
Found many strings related to Crypto-Wallets (likely being stolen)
Found pyInstaller with non standard icon
Tries to steal Crypto Currency Wallets
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win32.Patched.24562.10289.exe (PID: 4268 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe" MD5: D430FB367B17FDD8A5F7FD72C16E0477)
    • SecuriteInfo.com.Win32.Patched.24562.10289.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe" MD5: D430FB367B17FDD8A5F7FD72C16E0477)
      • cmd.exe (PID: 5340 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5540 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 6984 cmdline: C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • fsutil.exe (PID: 7060 cmdline: fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1 MD5: 452CA7574A1B2550CD9FF83DDBE87463)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: SecuriteInfo.com.Win32.Patched.24562.10289.exe PID: 6848JoeSecurity_GenericPythonRansomwareYara detected Generic Python RansomwareJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_046BE670 ??1QCryptographicHash@@QAE@XZ,3_2_046BE670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0470A160 ?hash@QMessageAuthenticationCode@@SA?AVQByteArray@@ABV2@0W4Algorithm@QCryptographicHash@@@Z,3_2_0470A160
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_046BE3D0 ?hashLength@QCryptographicHash@@SAHW4Algorithm@1@@Z,PyLong_FromLong,3_2_046BE3D0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0470ACB0 ??0QByteArray@@QAE@XZ,??0QMessageAuthenticationCode@@QAE@W4Algorithm@QCryptographicHash@@ABVQByteArray@@@Z,??1QByteArray@@QAE@XZ,??1QByteArray@@QAE@XZ,3_2_0470ACB0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_046BE860 ??1QCryptographicHash@@QAE@XZ,3_2_046BE860
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_046BEB00 ??0QCryptographicHash@@QAE@W4Algorithm@0@@Z,3_2_046BEB00
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\LICENSE_DEJAVU.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\SIL Open Font License.txtJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: certificate valid
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbDD source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905161824.0000000068CC0000.00000002.00000001.01000000.00000038.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055936180.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2031031108.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055791942.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055357295.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb++" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055357295.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905161824.0000000068CC0000.00000002.00000001.01000000.00000038.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056325812.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917882469.000000006F8AB000.00000002.00000001.01000000.0000000B.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3918392629.000000006F901000.00000020.00000001.01000000.00000006.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7mupx30s\src\rust\target\i686-pc-windows-msvc\release\deps\cryptography_rust.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_queue.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917365415.000000006F833000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917882469.000000006F8AB000.00000002.00000001.01000000.0000000B.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3916772173.000000006F715000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb!! source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915332521.000000006C342000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057608412.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: lblobi2d_providedcrypto\asn1\i2d_evp.ci2d_PrivateKeycrypto\passphrase.cossl_pw_set_passphraseossl_pw_set_pem_password_cbossl_pw_set_ossl_passphrase_cbossl_pw_set_ui_methoddo_ui_passphrasepass phraseossl_pw_get_passphrasePrompt info data type incorrectNo password method specifiedPVKcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllcrypto\initthread.cOPENSSL_ia32capp? source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056325812.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb(( source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055519714.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055549105.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915735484.000000006C4F4000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdbAA source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915332521.000000006C342000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055791942.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbTT source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056471003.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3914567980.000000006C2AC000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3909730644.000000006A351000.00000002.00000001.01000000.00000027.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055519714.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055549105.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3907773060.0000000069D46000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056471003.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3907517422.0000000069863000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:35 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915735484.000000006C4F4000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: lalgorpublic_keyX509_PUBKEYcrypto\x509\x_pubkey.cx509_pubkey_ex_new_exx509_pubkey_ex_d2i_exDERX509_PUBKEY_setx509_pubkey_decodeX509_PUBKEY_get0X509_PUBKEY_getPrivateKeyInfodo_pk8pkeycrypto\pem\pem_pk8.cd2i_PKCS8PrivateKey_bioENCRYPTED PRIVATE KEYPRIVATE KEYpem_read_bio_key_decodercrypto\pem\pem_pkey.cANY PRIVATE KEYPARAMETERSpem_read_bio_key_legacyPEM_write_bio_PrivateKey_traditional%s PRIVATE KEYtype-specificcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 16 00:14:00 2024 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files (x86)\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_00408F20 FindFirstFileExW,FindClose,0_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_00408F20 FindFirstFileExW,FindClose,3_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\iconengines\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\bearer\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\generic\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152216416.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116343186.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2118038383.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113801665.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147192887.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154473704.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150094671.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134684168.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2167159991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111465597.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134747715.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143852805.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175827518.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.jqueryui.com/category/theming/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue1230540
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2040035116.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiC
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057627179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056093216.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056513023.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060832278.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2036784771.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060615124.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056356309.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037918321.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2222059296.00000000007AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2222525289.0000000002CDA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2223804553.0000000002CDA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224764305.0000000002CDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099408343.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057627179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056093216.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060832278.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2036784771.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2039579699.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042352227.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060615124.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056356309.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037918321.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037918321.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-a
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057627179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056093216.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056513023.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060832278.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2036784771.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060615124.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056356309.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037918321.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057627179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056093216.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056513023.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060832278.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2036784771.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060615124.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056356309.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037918321.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176484279.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/License
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176484279.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903630723.00000000058B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.electrum.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2273385825.0000000003A63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.electrum.org/r
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896415516.0000000003200000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896557254.00000000032C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220401057.0000000002C82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://example.co
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3902672259.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3901013988.0000000004600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/romanz/amodem/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3901013988.0000000004600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/romanz/amodem/;
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237691242.00000000038FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099219936.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jacek.jedrzejewski.name)
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152216416.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116343186.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2118038383.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113801665.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147192887.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154473704.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150094671.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134684168.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2167159991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111465597.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134747715.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143852805.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175827518.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.org/license
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175438895.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2169936868.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132718277.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147029780.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2149774289.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2101351693.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2124497148.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157496095.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138256366.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152003824.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2119531424.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132875943.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113608155.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099219936.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/about
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2100775372.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2101568342.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgConten
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107513088.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=no
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111465597.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111314261.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerR
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2118038383.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2117876145.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerR
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2164195030.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2164458335.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsD
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2127832677.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2127589116.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2124497148.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2124734450.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175438895.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132718277.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132875943.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134684168.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134747715.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175827518.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2149774289.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138256366.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2119531424.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113608155.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2149714750.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113801665.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150094671.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2119698960.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2169936868.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160528690.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2167159991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2166882820.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2140992867.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bol
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143852805.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143874303.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143677772.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143655574.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147029780.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147192887.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172549878.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fw
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157496095.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152003824.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152216416.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116343186.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116148125.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2109909892.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152185790.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2110058462.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2151981294.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154473704.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2121932084.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2122170611.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154262493.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mynode.local:3002/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057627179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056093216.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056513023.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060832278.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2036784771.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2039579699.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060615124.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058028143.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056356309.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037918321.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2034584391.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895685466.0000000002E60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2215977916.0000000002CC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2177165283.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sc.symcb.com/sc.crl0W
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2177165283.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sc.symcb.com/sc.crt0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2177165283.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sc.symcd.com0&
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176298438.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questi
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176244493.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questi---
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176244493.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176298438.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-array
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2098316225.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2098216909.0000000000D90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/29186154/chrome-clicking-mailto-links-closes-websocket-connection
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2273425021.0000000003A12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommandFr
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895685466.0000000002E60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895737140.0000000002EA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2215977916.0000000002CC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237001042.000000000303F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Microsoft
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2177467444.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055166286.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/V
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa04
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmr.link
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://yahoo.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://3xpl.com/bitcoin/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2097439164.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2097418553.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://EditorConfig.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903170065.0000000005710000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/#/electrum-help
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2182448111.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903955364.00000000059B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/2/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897866466.0000000003AFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/2/c
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockchain.com/btc/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockchair.com/bitcoin/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockstream.info/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockstream.info/testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://btc.bitaps.com/r
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://btc.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897094882.00000000035C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue42130
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chainflyer.bitflyer.jp/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897605402.00000000038B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cryptoname.co/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897094882.00000000035C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2238525775.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2241356534.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242545938.0000000002FD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2238525775.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2241356534.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242545938.0000000002FD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224960603.0000000003042000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224608904.0000000003003000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224960603.0000000003042000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903630723.00000000058B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2273385825.0000000003A63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://electrum.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2273425021.0000000003A12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903873170.0000000005970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/#download
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903873170.0000000005970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/version
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903873170.0000000005970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://electrum.org/versionr
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://en.w
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ex.signet.bublina.eu.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://explorer.bc-2.jp/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896322584.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897282305.00000000036D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093273663.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blockstream/Jade)
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093273663.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blockstream/Jade/releases/tag/1.0.29).
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903873170.0000000005970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ColinDuquesnoy/QDarkStyleSheet/issues/200
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2096935865.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2096131809.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2096059627.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2096131809.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/LedgerHQ/ledgercomm/blob/bc5ada865980cb63c2b9b71a916e01f2f8e53716/ledgercomm/inte
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2204274538.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206879957.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897094882.00000000035C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178553184.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/archos-safe-t/python-safet
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3898987186.0000000003E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitcoin-core/HWI/blob/5f300d3dee7b317a6194680ad293eaa0962a3cc7/hwilib/key.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895737140.0000000002EA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099408343.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery-ui
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2094497437.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/keepkey/python-keepkey
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242545938.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000302F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894963625.0000000002810000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206847907.0000000000BE9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2204274538.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206879957.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86296
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897094882.00000000035C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897605402.00000000038B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/romis2012/python-socks
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899180485.0000000003F80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899180485.0000000003F80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum/issues
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2094168117.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2094260180.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum/issues/7779
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/stefankoegl/python-json-patch
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/stefankoegl/python-json-patchng
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/stefankoegl/python-json-pointer
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2204274538.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206879957.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178138454.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178111626.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.p
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2179830252.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trezor/trezor-firmware/issues/1167
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2180420002.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178634254.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178553184.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trezor/trezor-mcu/pull/306
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897513932.0000000003830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/1323#issuecomment-362494839
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3898810999.0000000003D30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/497
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://insight.bitpay.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099408343.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jquery.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://live.blockcypher.com/btc-testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://live.blockcypher.com/btc/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.emzy.de/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/signet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://openalias.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oxt.me/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2180335412.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/trezor/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896322584.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2177418259.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://revealer.cc/revealer-warning-and-upgrade/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178553184.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://safe-t.io
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2213963496.0000000002C6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signet.bitcoinexplorer.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2233339753.0000000003117000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/13624858
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2238525775.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2241356534.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242545938.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224608904.0000000003003000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224960603.0000000003042000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://swaps.electrum.org/api
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://swaps.electrum.org/testnet
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tbtc.bitaps.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://testnet.smartbit.com.au/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237866786.0000000003905000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3898810999.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237691242.00000000038FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237691242.00000000038FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2180335412.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wallet.trezor.io
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.python.org/moin/DunderAlias
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.blockchain.com/btc-testnet/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.blockonomics.co/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.chain.so/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042352227.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.6T6X6
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037439173.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057109951.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055386544.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2035607926.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2058382952.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060722436.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037888801.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056974458.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042379807.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033835991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2094497437.0000000000D89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.keepkey.com
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896953265.00000000034F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0506/
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895122046.0000000002B10000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205721333.0000000000776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Yara detected Generic Python Ransomware
    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.Patched.24562.10289.exe PID: 6848, type: MEMORYSTR
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004099490_2_00409949
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004131C00_2_004131C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_00410A200_2_00410A20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004145700_2_00414570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004095E60_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004095E60_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_0040A6700_2_0040A670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_0040AF900_2_0040AF90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004099493_2_00409949
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004131C03_2_004131C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_00410A203_2_00410A20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004145703_2_00414570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004095E63_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004095E63_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0040A6703_2_0040A670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0040AF903_2_0040AF90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: String function: 00402ED0 appears 132 times
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: String function: 00402F90 appears 214 times
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: String function: 04759483 appears 88 times
    Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: libzbar-0.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: libusb-1.0.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: python3.dll.0.drStatic PE information: No import functions for PE file found
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057850838.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedsengine.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2031031108.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2033807578.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2030776654.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056221586.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038632375.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056513023.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057608412.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2060500975.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2038817711.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WebSockets.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055357295.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtaudio_wasapi.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055936180.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2036376967.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5PrintSupport.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2037412105.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2042022381.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055688142.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgenericbearer.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055791942.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055519714.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtaudio_windows.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056325812.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057223834.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055166286.0000000000D88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamessleay32.dllH vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917014406.000000006F72C000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3907554840.0000000069866000.00000002.00000001.01000000.0000002E.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913233438.000000006BC2F000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3908757695.0000000069EBB000.00000002.00000001.01000000.0000002A.sdmpBinary or memory string: OriginalFilenameQt5Multimedia.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3906018383.0000000068DBB000.00000002.00000001.01000000.00000034.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905046954.0000000068C86000.00000002.00000001.01000000.00000039.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3906536973.0000000068DE8000.00000002.00000001.01000000.00000031.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905238009.0000000068CE4000.00000002.00000001.01000000.00000038.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917436220.000000006F836000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3914922372.000000006C2AE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905599976.0000000068D3E000.00000002.00000001.01000000.00000036.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3918464652.000000006F911000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Win32.Patched.24562.10289.exe
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
    Source: Qt5Core.dll.0.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
    Source: libsecp256k1-2.dll.0.drStatic PE information: Section: .rdata ZLIB complexity 0.9982626488095238
    Source: classification engineClassification label: mal60.rans.spyw.winEXE@14/874@0/1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004086F0 FormatMessageW,WideCharToMultiByte,GetLastError,0_2_004086F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libffi-7.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libcrypto-1_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libssl-1_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: hid.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: sqlite3.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5core.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: msvcp140.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: msvcp140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5gui.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d11.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dxgi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5widgets.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5multimedia.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5network.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d9.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: opengl32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: glu32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: appxdeploymentclient.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libegl.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: libglesv2.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dcomp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: resourcepolicyclient.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dxcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: qt5svg.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: dataexchange.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: certificate valid
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic file information: File size 47764104 > 1048576
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbDD source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905161824.0000000068CC0000.00000002.00000001.01000000.00000038.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056928352.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055936180.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2031031108.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055791942.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055357295.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb++" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055357295.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057256179.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3905161824.0000000068CC0000.00000002.00000001.01000000.00000038.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056325812.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_lzma.pdbOO source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917882469.000000006F8AB000.00000002.00000001.01000000.0000000B.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3918392629.000000006F901000.00000020.00000001.01000000.00000006.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7mupx30s\src\rust\target\i686-pc-windows-msvc\release\deps\cryptography_rust.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_queue.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917365415.000000006F833000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_lzma.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3917882469.000000006F8AB000.00000002.00000001.01000000.0000000B.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057069645.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3916772173.000000006F715000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb!! source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056064792.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056192074.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915332521.000000006C342000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057608412.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: lblobi2d_providedcrypto\asn1\i2d_evp.ci2d_PrivateKeycrypto\passphrase.cossl_pw_set_passphraseossl_pw_set_pem_password_cbossl_pw_set_ossl_passphrase_cbossl_pw_set_ui_methoddo_ui_passphrasepass phraseossl_pw_get_passphrasePrompt info data type incorrectNo password method specifiedPVKcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllcrypto\initthread.cOPENSSL_ia32capp? source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056325812.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb(( source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055519714.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055549105.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915735484.000000006C4F4000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\libssl-1_1.pdbAA source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915332521.000000006C342000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055658515.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb"" source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055791942.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbTT source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056471003.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3914567980.000000006C2AC000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3909730644.000000006A351000.00000002.00000001.01000000.00000027.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055519714.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055549105.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3907773060.0000000069D46000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2056471003.0000000000D8C000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2057437458.0000000000D88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2041983489.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3907517422.0000000069863000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:35 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3915735484.000000006C4F4000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: lalgorpublic_keyX509_PUBKEYcrypto\x509\x_pubkey.cx509_pubkey_ex_new_exx509_pubkey_ex_d2i_exDERX509_PUBKEY_setx509_pubkey_decodeX509_PUBKEY_get0X509_PUBKEY_getPrivateKeyInfodo_pk8pkeycrypto\pem\pem_pk8.cd2i_PKCS8PrivateKey_bioENCRYPTED PRIVATE KEYPRIVATE KEYpem_read_bio_key_decodercrypto\pem\pem_pkey.cANY PRIVATE KEYPARAMETERSpem_read_bio_key_legacyPEM_write_bio_PrivateKey_traditional%s PRIVATE KEYtype-specificcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 16 00:14:00 2024 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files (x86)\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmp
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_004014F0
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeStatic PE information: section name: /4
    Source: MSVCP140.dll.0.drStatic PE information: section name: .didat
    Source: Qt5Core.dll.0.drStatic PE information: section name: .qtmimed
    Source: opengl32sw.dll.0.drStatic PE information: section name: _RDATA
    Source: qtaudio_wasapi.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtaudio_windows.dll.0.drStatic PE information: section name: .qtmetad
    Source: qgenericbearer.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtuiotouchplugin.dll.0.drStatic PE information: section name: .qtmetad
    Source: qsvgicon.dll.0.drStatic PE information: section name: .qtmetad
    Source: qgif.dll.0.drStatic PE information: section name: .qtmetad
    Source: qicns.dll.0.drStatic PE information: section name: .qtmetad
    Source: qico.dll.0.drStatic PE information: section name: .qtmetad
    Source: qjpeg.dll.0.drStatic PE information: section name: .qtmetad
    Source: qsvg.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtga.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtiff.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwbmp.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwebp.dll.0.drStatic PE information: section name: .qtmetad
    Source: dsengine.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtmedia_audioengine.dll.0.drStatic PE information: section name: .qtmetad
    Source: wmfengine.dll.0.drStatic PE information: section name: .qtmetad
    Source: qminimal.dll.0.drStatic PE information: section name: .qtmetad
    Source: qoffscreen.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwebgl.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwindows.dll.0.drStatic PE information: section name: .qtmetad
    Source: qxdgdesktopportal.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtmultimedia_m3u.dll.0.drStatic PE information: section name: .qtmetad
    Source: windowsprintersupport.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwindowsvistastyle.dll.0.drStatic PE information: section name: .qtmetad
    Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
    Source: libsecp256k1-2.dll.0.drStatic PE information: section name: /4
    Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
    Source: libusb-1.0.dll.0.drStatic PE information: section name: /4
    Source: libzbar-0.dll.0.drStatic PE information: section name: /4
    Source: python310.dll.0.drStatic PE information: section name: PyRuntim
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004208BF push 41100E0Ah; ret 0_2_004208E0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_0041B970 push ds; ret 0_2_0041B978
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_0041C3EB push ebx; iretd 0_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_0041C467 push ebx; iretd 0_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004208BF push 41100E0Ah; ret 3_2_004208E0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0041B970 push ds; ret 3_2_0041B978
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0041C3EB push ebx; iretd 3_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0041C467 push ebx; iretd 3_2_0041C470

    Persistence and Installation Behavior

    barindex
    Found pyInstaller with non standard icon
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\libsecp256k1-2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\sqlite3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtWidgets.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\sip.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Gui.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_windows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\libcrypto-1_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtCore.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\libzbar-0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\libffi-7.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\dsengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\hid.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\libusb-1.0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\python310.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\bearer\qgenericbearer.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Core.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\libssl-1_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\wmfengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtPrintSupport.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Widgets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libeay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\ssleay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5PrintSupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtNetwork.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_cffi_backend.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Multimedia.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtGui.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\VCRUNTIME140.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtMultimedia.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\LICENSE_DEJAVU.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\SIL Open Font License.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_00406D50 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00406D50
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeWindow / User API: foregroundWindowGot 687Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\libsecp256k1-2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtWidgets.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\sip.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_windows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtCore.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\libzbar-0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\dsengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\hid.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\libusb-1.0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\python310.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\bearer\qgenericbearer.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\wmfengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtPrintSupport.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libeay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\ssleay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5PrintSupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_cffi_backend.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtNetwork.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtGui.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtMultimedia.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-19792
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeAPI coverage: 8.6 %
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeAPI coverage: 0.9 %
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_00408F20 FindFirstFileExW,FindClose,0_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_00408F20 FindFirstFileExW,FindClose,3_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\iconengines\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\bearer\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\generic\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093102510.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093148044.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: # Maybe look for Jade Qemu simulator if the vars are set (experimental)
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093102510.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093148044.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: # For testing with qemu simulator (experimental)
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093102510.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093148044.0000000000D86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: id_='Jade Qemu Simulator',
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3911192477.000000006B0F8000.00000008.00000001.01000000.00000025.sdmpBinary or memory string: j.?AVQEmulationPaintEngine@@
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3911192477.000000006B0F8000.00000008.00000001.01000000.00000025.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0475A3AE IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0475A3AE
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_004014F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_0040117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,_amsg_exit,_initterm,GetStartupInfoW,_cexit,_initterm,exit,0_2_0040117C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,0_2_00401170
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 0_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,0_2_004011B3
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0040117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,_amsg_exit,_initterm,GetStartupInfoW,_cexit,_initterm,exit,3_2_0040117C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,3_2_00401170
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,3_2_004011B3
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0475A0AB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_0475A0AB
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0475A3AE IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0475A3AE
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0475A1CD cpuid 3_2_0475A1CD
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_ctypes.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_bz2.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_lzma.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_socket.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\select.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\pyexpat.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_queue.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_ssl.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_asyncio.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_overlapped.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_hashlib.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\certifi\cacert.pem VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\_decimal.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682\unicodedata.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI42682 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeCode function: 3_2_0475A554 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,3_2_0475A554
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Stealing of Sensitive Information

    barindex
    Found many strings related to Crypto-Wallets (likely being stolen)
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exeString found in binary or memory: tagged by Electrum@7263a49129d14db288a01b0b9d569422baddf5e1
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2183288451.0000000000D86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "btc.electroncash.dk": {
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2096059627.0000000000D88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: def get_singlesig_default_wallet_policy(self, addr_type: 'AddressType', account: int) -> 'WalletPolicy':
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895225954.0000000002B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: safetlib.messages.EthereumAddress
    Source: SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2095753362.0000000000D87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: registers_keystore = ('hardware', 'ledger', _("Ledger wallet"))
    Tries to steal Crypto Currency Wallets
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\forksJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\recent_serversJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\certsJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\cache\CoinGecko_EURJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\cacheJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\ElectrumJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\forksJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\forks\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\certsJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\cacheJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\configJump to behavior
    Source: C:\Windows\SysWOW64\fsutil.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\blockchain_headersJump to behavior

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
    Native API    		1
    DLL Side-Loading    		11
    Process Injection    		1
    Masquerading    		OS Credential Dumping1
    System Time Discovery    		Remote Services1
    Archive Collected Data    		2
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    DLL Side-Loading    		11
    Process Injection    		LSASS Memory11
    Security Software Discovery    		Remote Desktop Protocol2
    Data from Local System    		Junk DataExfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Deobfuscate/Decode Files or Information    		Security Account Manager1
    Application Window Discovery    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
    Obfuscated Files or Information    		NTDS2
    File and Directory Discovery    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    Software Packing    		LSA Secrets23
    System Information Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    DLL Side-Loading    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1505139 Sample: SecuriteInfo.com.Win32.Patc... Startdate: 05/09/2024 Architecture: WINDOWS Score: 60 46 Yara detected Generic Python Ransomware 2->46 48 Found many strings related to Crypto-Wallets (likely being stolen) 2->48 8 SecuriteInfo.com.Win32.Patched.24562.10289.exe 1001 2->8         started        process3 file4 32 C:\Users\user\AppData\...\unicodedata.pyd, PE32 8->32 dropped 34 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 8->34 dropped 36 C:\Users\user\AppData\Local\...\select.pyd, PE32 8->36 dropped 38 163 other files (none is malicious) 8->38 dropped 52 Found many strings related to Crypto-Wallets (likely being stolen) 8->52 54 Found pyInstaller with non standard icon 8->54 12 SecuriteInfo.com.Win32.Patched.24562.10289.exe 7 8->12         started        signatures5 process6 dnsIp7 44 127.0.0.1 unknown unknown 12->44 40 C:\Users\user\AppData\Roaming\...\config, JSON 12->40 dropped 42 C:\Users\user\AppData\...\blockchain_headers, data 12->42 dropped 56 Found many strings related to Crypto-Wallets (likely being stolen) 12->56 58 Tries to steal Crypto Currency Wallets 12->58 17 cmd.exe 1 12->17         started        19 cmd.exe 1 12->19         started        21 cmd.exe 12->21         started        file8 signatures9 process10 process11 23 fsutil.exe 1 17->23         started        26 conhost.exe 17->26         started        28 conhost.exe 19->28         started        30 conhost.exe 21->30         started        signatures12 50 Tries to steal Crypto Currency Wallets 23->50

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    SecuriteInfo.com.Win32.Patched.24562.10289.exe3%ReversingLabs

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140_1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Core.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5DBus.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Gui.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Multimedia.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Network.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5PrintSupport.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Qml.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5QmlModels.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Quick.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Svg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5WebSockets.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Widgets.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\d3dcompiler_47.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libEGL.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libGLESv2.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libeay32.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\opengl32sw.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\ssleay32.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_windows.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\bearer\qgenericbearer.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qgif.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qicns.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qico.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qjpeg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qsvg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtga.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtiff.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwbmp.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwebp.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\dsengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\wmfengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qminimal.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qoffscreen.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwebgl.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwindows.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtCore.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtGui.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtMultimedia.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtNetwork.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtPrintSupport.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtWidgets.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\sip.cp310-win32.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\VCRUNTIME140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_asyncio.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_bz2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_cffi_backend.cp310-win32.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_ctypes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_decimal.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_hashlib.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_lzma.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_multiprocessing.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_overlapped.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_queue.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_socket.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_sqlite3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_ssl.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\_uuid.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\backup_commands_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\bitbox02_system_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\btc_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\common_pb2.pyi0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://httpbin.org/get0%URL Reputationsafe
    https://www.python.org/dev/peps/pep-0506/0%Avira URL Cloudsafe
    http://www.openssl.org/V0%URL Reputationsafe
    https://EditorConfig.org0%Avira URL Cloudsafe
    http://api.jqueryui.com/category/theming/0%Avira URL Cloudsafe
    https://github.com/keepkey/python-keepkey0%Avira URL Cloudsafe
    http://github.com/romanz/amodem/;0%Avira URL Cloudsafe
    https://cloud.google.com/appengine/docs/standard/runtimes0%Avira URL Cloudsafe
    https://github.com/pyca/cryptography/issues/89960%Avira URL Cloudsafe
    https://testnet.smartbit.com.au/0%Avira URL Cloudsafe
    http://jqueryui.com0%Avira URL Cloudsafe
    http://bugs.python.org/issue12305400%Avira URL Cloudsafe
    https://httpbin.org/post0%URL Reputationsafe
    https://github.com/aio-libs/aiohttp/discussions/60440%Avira URL Cloudsafe
    https://github.com/stefankoegl/python-json-pointer0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerR0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=0%Avira URL Cloudsafe
    https://github.com/stefankoegl/python-json-patchng0%Avira URL Cloudsafe
    https://github.com/Blockstream/Jade)0%Avira URL Cloudsafe
    https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#0%Avira URL Cloudsafe
    https://tools.ietf.org/html/rfc2388#section-4.40%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=10%Avira URL Cloudsafe
    http://www.opensource.org/licenses/mit-license.php0%Avira URL Cloudsafe
    https://refspecs.linuxfoundation.org/elf/gabi40%Avira URL Cloudsafe
    http://docs.python.org/3/library/subprocess#subprocess.Popen.kill0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bol0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerR0%Avira URL Cloudsafe
    https://github.com/python-attrs/attrs/issues/1360%Avira URL Cloudsafe
    https://github.com/romis2012/python-socks0%Avira URL Cloudsafe
    http://www.jiyu-kobo.co.jp/Microsoft0%Avira URL Cloudsafe
    https://oxt.me/0%Avira URL Cloudsafe
    https://zopeinterface.readthedocs.io/en/latest/0%Avira URL Cloudsafe
    https://github.com/spesmilo/electrum0%Avira URL Cloudsafe
    https://docs.python.org/3/library/pprint.html0%Avira URL Cloudsafe
    https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6880%Avira URL Cloudsafe
    http://httpbin.org/0%Avira URL Cloudsafe
    http://jacek.jedrzejewski.name)0%Avira URL Cloudsafe
    https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access0%Avira URL Cloudsafe
    https://api.trustedcoin.com/2/0%Avira URL Cloudsafe
    https://electrum.org/version0%Avira URL Cloudsafe
    http://docs.electrum.org/r0%Avira URL Cloudsafe
    https://btc.com/0%Avira URL Cloudsafe
    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader0%Avira URL Cloudsafe
    https://mempool.space/testnet/0%Avira URL Cloudsafe
    https://httpbin.org/0%Avira URL Cloudsafe
    http://xmr.link0%Avira URL Cloudsafe
    http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%Avira URL Cloudsafe
    http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommandFr0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=no0%Avira URL Cloudsafe
    https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file0%Avira URL Cloudsafe
    http://www.symauth.com/cps0(0%Avira URL Cloudsafe
    http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5350%Avira URL Cloudsafe
    https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy0%Avira URL Cloudsafe
    https://jquery.org/0%Avira URL Cloudsafe
    https://live.blockcypher.com/btc/0%Avira URL Cloudsafe
    https://docs.python.org/3/library/re.html0%Avira URL Cloudsafe
    https://wiki.debian.org/XDGBaseDirectorySpecification#state0%Avira URL Cloudsafe
    http://wwwsearch.sf.net/):0%Avira URL Cloudsafe
    https://mempool.emzy.de/0%Avira URL Cloudsafe
    https://btc.bitaps.com/r0%Avira URL Cloudsafe
    http://tools.ietf.org/html/rfc6125#section-6.4.30%Avira URL Cloudsafe
    https://wallet.trezor.io0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault0%Avira URL Cloudsafe
    https://github.com/trezor/trezor-mcu/pull/3060%Avira URL Cloudsafe
    https://blockchain.com/btc/0%Avira URL Cloudsafe
    http://stackoverflow.com/questi0%Avira URL Cloudsafe
    https://bugs.python.org/issue371790%Avira URL Cloudsafe
    https://blockchair.com/bitcoin/0%Avira URL Cloudsafe
    https://mempool.space/0%Avira URL Cloudsafe
    http://github.com/romanz/amodem/0%Avira URL Cloudsafe
    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py0%Avira URL Cloudsafe
    https://github.com/jaraco/jaraco.functools/issues/50%Avira URL Cloudsafe
    http://www.symauth.com/rpa040%Avira URL Cloudsafe
    http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm0%Avira URL Cloudsafe
    http://dejavu.sourceforge.net/wiki/index.php/License0%Avira URL Cloudsafe
    https://github.com/pyca/cryptography/issues0%Avira URL Cloudsafe
    https://www.keepkey.com0%Avira URL Cloudsafe
    http://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-array0%Avira URL Cloudsafe
    http://example.co0%Avira URL Cloudsafe
    https://chainflyer.bitflyer.jp/0%Avira URL Cloudsafe
    https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
    https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.0%Avira URL Cloudsafe
    http://google.com/0%Avira URL Cloudsafe
    https://blockstream.info/0%Avira URL Cloudsafe
    https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.p0%Avira URL Cloudsafe
    https://mempool.space/signet/0%Avira URL Cloudsafe
    https://insight.bitpay.com/0%Avira URL Cloudsafe
    https://github.com0%Avira URL Cloudsafe
    https://www.python.org/download/releases/2.3/mro/.0%Avira URL Cloudsafe
    https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy0%Avira URL Cloudsafe
    http://jquery.org/license0%Avira URL Cloudsafe
    https://docs.python.org/3/library/asyncio-eventloop.html0%Avira URL Cloudsafe
    https://github.com/jquery/jquery-ui0%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsD0%Avira URL Cloudsafe
    http://python.org/0%Avira URL Cloudsafe
    https://github.com/trezor/trezor-firmware/issues/11670%Avira URL Cloudsafe
    http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fw0%Avira URL Cloudsafe
    https://github.com/Ousret/charset_normalizer0%Avira URL Cloudsafe
    https://en.w0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://github.com/romanz/amodem/;SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3901013988.0000000004600000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://EditorConfig.orgSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2097439164.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2097418553.0000000000D87000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/pyca/cryptography/issues/8996SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://cloud.google.com/appengine/docs/standard/runtimesSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897605402.00000000038B0000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://bugs.python.org/issue1230540SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/keepkey/python-keepkeySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2094497437.0000000000D89000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://testnet.smartbit.com.au/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://www.python.org/dev/peps/pep-0506/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896953265.00000000034F0000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.comSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175438895.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2169936868.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132718277.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147029780.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2149774289.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2101351693.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2124497148.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157496095.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138256366.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152003824.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2119531424.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132875943.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113608155.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://api.jqueryui.com/category/theming/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152216416.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116343186.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2118038383.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113801665.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147192887.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154473704.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150094671.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134684168.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2167159991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111465597.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134747715.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143852805.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175827518.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/aio-libs/aiohttp/discussions/6044SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897094882.00000000035C0000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2169936868.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160528690.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111465597.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111314261.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2204274538.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206879957.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/stefankoegl/python-json-pointerSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/stefankoegl/python-json-patchngSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://tools.ietf.org/html/rfc2388#section-4.4SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/Blockstream/Jade)SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2093273663.0000000000D87000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157496095.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152003824.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152216416.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116343186.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116148125.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2109909892.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152185790.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2110058462.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2151981294.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.opensource.org/licenses/mit-license.phpSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2177467444.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://refspecs.linuxfoundation.org/elf/gabi4SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896322584.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bolSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2167159991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2166882820.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2140992867.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://docs.python.org/3/library/subprocess#subprocess.Popen.killSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3896415516.0000000003200000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.jiyu-kobo.co.jp/MicrosoftSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/python-attrs/attrs/issues/136SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2118038383.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2117876145.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://oxt.me/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://github.com/spesmilo/electrumSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899180485.0000000003F80000.00000004.00001000.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154473704.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2121932084.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2122170611.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154262493.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      		unknown
      https://github.com/romis2012/python-socksSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897605402.00000000038B0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://zopeinterface.readthedocs.io/en/latest/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/pprint.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2238525775.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2241356534.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242545938.0000000002FD2000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894963625.0000000002810000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206847907.0000000000BE9000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/getSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://httpbin.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://docs.electrum.org/rSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2273385825.0000000003A63000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accessSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2213963496.0000000002C6E000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://api.trustedcoin.com/2/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2182448111.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903955364.00000000059B0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://electrum.org/versionSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3903873170.0000000005970000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jacek.jedrzejewski.name)SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099219936.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://btc.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2204274538.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206879957.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.space/testnet/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://xmr.linkSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3899650797.0000000004150000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-fileSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CD4000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommandFrSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2273425021.0000000003A12000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.symauth.com/cps0(SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=noSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107513088.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2204274538.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206879957.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/re.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2224960603.0000000003042000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://jquery.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099408343.0000000000D87000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://live.blockcypher.com/btc/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.emzy.de/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://wiki.debian.org/XDGBaseDirectorySpecification#stateSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3894327344.00000000006F8000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://wwwsearch.sf.net/):SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://tools.ietf.org/html/rfc6125#section-6.4.3SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895685466.0000000002E60000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://btc.bitaps.com/rSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefaultSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175438895.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132718277.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2132875943.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134684168.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134747715.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175827518.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://wallet.trezor.ioSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2180335412.0000000000D89000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/trezor/trezor-mcu/pull/306SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2180420002.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178634254.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178553184.0000000000D89000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://bugs.python.org/issue37179SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897094882.00000000035C0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockchain.com/btc/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockchair.com/bitcoin/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://stackoverflow.com/questiSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176298438.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.space/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.symauth.com/rpa04SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176962564.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176899671.0000000000D88000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/jaraco/jaraco.functools/issues/5SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895737140.0000000002EA0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205412182.0000000000761000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://github.com/romanz/amodem/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3902672259.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3901013988.0000000004600000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2216065168.0000000002CD4000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://dejavu.sourceforge.net/wiki/index.php/LicenseSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176484279.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-arraySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176244493.0000000000D88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2176298438.0000000000D8F000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/pyca/cryptography/issuesSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3913976663.000000006C074000.00000002.00000001.01000000.00000019.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://www.keepkey.comSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2094497437.0000000000D89000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://example.coSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220401057.0000000002C82000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://google.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237691242.00000000038FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://chainflyer.bitflyer.jp/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mahler:8092/site-updates.pySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://blockstream.info/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mempool.space/signet/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.pSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178138454.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2178111626.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://insight.bitpay.com/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2232555786.00000000030FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jquery.org/licenseSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2157775396.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2107657852.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2138633371.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2160791058.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150054137.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2170172607.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2141344769.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2152216416.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2116343186.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2118038383.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2113801665.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147192887.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2154473704.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2150094671.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134684168.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2167159991.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2111465597.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2134747715.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2143852805.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2175827518.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.openssl.org/VSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2055166286.0000000000D88000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://www.python.org/download/releases/2.3/mro/.SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895122046.0000000002B10000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2205721333.0000000000776000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.comSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897282305.00000000036D0000.00000004.00001000.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxySecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237866786.0000000003905000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3898810999.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2237691242.00000000038FE000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://docs.python.org/3/library/asyncio-eventloop.htmlSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/jquery/jquery-uiSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2099408343.0000000000D87000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2164195030.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2164458335.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172780743.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147029780.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2147192887.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2172549878.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/postSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895327676.0000000002C38000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://github.com/trezor/trezor-firmware/issues/1167SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000000.00000003.2179830252.0000000000D86000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://python.org/SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3895886194.000000000303D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2242957335.000000000303D000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://en.wSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2218915293.0000000000752000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2217530376.000000000074F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2206450001.0000000000761000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000003.2220078213.0000000000752000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://github.com/Ousret/charset_normalizerSecuriteInfo.com.Win32.Patched.24562.10289.exe, 00000003.00000002.3897653550.00000000038F0000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious

      Private

      IP
      127.0.0.1

      General Information

      Joe Sandbox version:40.0.0 Tourmaline
      Analysis ID:1505139
      Start date and time:2024-09-05 20:37:33 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 10m 15s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Run name:Run with higher sleep bypass
      Number of analysed new started processes analysed:14
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:SecuriteInfo.com.Win32.Patched.24562.10289.exe
      Detection:MAL
      Classification:mal60.rans.spyw.winEXE@14/874@0/1
      EGA Information:
      • Successful, ratio: 100%
      HCA Information:
      • Successful, ratio: 98%
      • Number of executed functions: 50
      • Number of non-executed functions: 494
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

      Warnings

      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
      • Not all processes where analyzed, report is missing behavior information
      • Report size exceeded maximum capacity and may have missing behavior information.
      • Report size exceeded maximum capacity and may have missing disassembly code.
      • Report size getting too big, too many NtCreateFile calls found.
      • Report size getting too big, too many NtOpenFile calls found.
      • Report size getting too big, too many NtProtectVirtualMemory calls found.
      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
      • Report size getting too big, too many NtSetInformationFile calls found.
      • VT rate limit hit for: SecuriteInfo.com.Win32.Patched.24562.10289.exe

      Simulations

      Behavior and APIs

      ⊘No simulations

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140.dllfr#U0435#U0435#U041a#U041cS#U0410ut#U043e#U279cN#U0435t#U279cP#U043ert#U0430bl#U0435##U28e4.zip.7zGet hashmaliciousUnknownBrowse
        SecuriteInfo.com.Win32.Patched.29806.7109.exeGet hashmaliciousUnknownBrowse
          electrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
            electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
              BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                https://files.jalinga.com/builds/releases/jalinga_studio.4.0.2040.0.exeGet hashmaliciousUnknownBrowse
                  MedMooc.exeGet hashmaliciousUnknownBrowse
                    FileZilla_3.52.2_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                      f_026dfd.exeGet hashmaliciousUnknownBrowse
                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140_1.dllBrowser.exeGet hashmaliciousUnknownBrowse
                          SecuriteInfo.com.Win32.Patched.29806.7109.exeGet hashmaliciousUnknownBrowse
                            electrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
                              electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
                                BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                                  https://files.jalinga.com/builds/releases/jalinga_studio.4.0.2040.0.exeGet hashmaliciousUnknownBrowse
                                    CABPRansom.exeGet hashmaliciousUnknownBrowse
                                      MedMooc.exeGet hashmaliciousUnknownBrowse

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):454128
                                        Entropy (8bit):6.669498628019609
                                        Encrypted:false
                                        SSDEEP:12288:y9vcHNFaPZ2Jj/gMvpbUUtQgTCZuGre6gIo1hUgiW6QR7t5s03Ooc8dHkC2esrVx:ytcHNa2Jj/g4bUUtQgTn6g003Ooc8dHE
                                        MD5:ECEFF9C92E14B580EA84365F3D60F7DE
                                        SHA1:00699126456379FA48CB122E21B7F4731A72C57C
                                        SHA-256:265591A709A5DB413D73C95B538DA321EDEACB40059BDCEB142F997A3D458B49
                                        SHA-512:FD325D77EB2C30E1CD1B2D871986E057318C1BE911793521C7BF79FB2C5DC359CB7DB90C6D6C5711FEDD734B6B03117B8BAF241DFBD78585CF55A25983EC8727
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Joe Sandbox View:
                                        • Filename: fr#U0435#U0435#U041a#U041cS#U0410ut#U043e#U279cN#U0435t#U279cP#U043ert#U0430bl#U0435##U28e4.zip.7z, Detection: malicious, Browse
                                        • Filename: SecuriteInfo.com.Win32.Patched.29806.7109.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                        • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                        • Filename: , Detection: malicious, Browse
                                        • Filename: MedMooc.exe, Detection: malicious, Browse
                                        • Filename: FileZilla_3.52.2_win64_sponsored-setup.exe, Detection: malicious, Browse
                                        • Filename: f_026dfd.exe, Detection: malicious, Browse
                                        Reputation:moderate, very likely benign file
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mw`...3...3...3C..3...3.t.3...3...36..3<c.2...3<c.2...3<c.2...3<c.2g..3<c.2...3<c.3...3<c.2...3Rich...3........PE..L.....t^.........."!.....:...................P......................................_Y....@A.........................z...................................A.......;...z..8...........................Xy..@....................v..@....................text....9.......:.................. ..`.data...t(...P.......>..............@....idata...............V..............@..@.didat..4............j..............@....rsrc................l..............@..@.reloc...;.......<...p..............@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\MSVCP140_1.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29168
                                        Entropy (8bit):6.891197126129158
                                        Encrypted:false
                                        SSDEEP:384:ipMyA7o+HvwTgljud5u+NWc95gWWzc+pBj0HRN7LxlT3cyHRN7/Ujp9fl980:IU0AJsd5uceWncFv
                                        MD5:7F71F19F30BE3942EE0EFDDC145D459E
                                        SHA1:863048CF8A9692BF43317326C5AA918389546282
                                        SHA-256:B8CAFC52B903ED0824882365B0A0D438460260B4DDF2487849EB3BD2241F7E8D
                                        SHA-512:4FDFBC7524445EB443E189F64D9732C5C28ACE689C9556B67C8F3647BA7F18B02521DEEAE4FB8138F5F550EE34EFDB2AB2B6FFEA3A43D184A26BDFCE700B2DD5
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Joe Sandbox View:
                                        • Filename: Browser.exe, Detection: malicious, Browse
                                        • Filename: SecuriteInfo.com.Win32.Patched.29806.7109.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                        • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                        • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                        • Filename: , Detection: malicious, Browse
                                        • Filename: CABPRansom.exe, Detection: malicious, Browse
                                        • Filename: MedMooc.exe, Detection: malicious, Browse
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................'G......~....X......X............X......X......X......X......X......Rich....................PE..L.....t^.........."!.........................0...............................p......W.....@A.........................*..J....@..x....P...............0...A...`......h...8...............................@............@...............................text............................... ..`.data...H....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Core.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):5381616
                                        Entropy (8bit):6.852156967958758
                                        Encrypted:false
                                        SSDEEP:49152:q1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eO:E5gje5lCjzJsv6tWKFdu9CtvDhgwcY
                                        MD5:7D180286E9C071C7BC3A6BC2ACE792AC
                                        SHA1:F5947D69AEAACC8A378721F3750B049CC41DDDEF
                                        SHA-256:4F8DC460162407CFCCB1BE6EF9CCE45C4449DE838AEFFA3FD33378F01A3F9CC4
                                        SHA-512:9B30D5DD48E736DA770E71622B79DA294829621565CFC4D995CA31C8CFBBBE2D577677F4240E0FF2D995DEEEB5F894018412596C141E8360DD77BF12596CE167
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........S.G.2k..2k..2k..J...2k.p]j..2k.%....2k.p]n..2k.p]o..2k.p]h..2k..Yo..2k..Ym..2k..Yj..2k..2j..3k.=Bo..2k.=Bn.D2k.=Bk..2k.=B...2k..2...2k.=Bi..2k.Rich.2k.........................PE..L...&._...........!......(...).....>x&.......(....g.........................pR.......R...@.........................P D.P....=K.......P...............R.......P..|.. .A.T...................0.A.....x.A.@.............(..............................text...W.(.......(................. ..`.rdata..n."...(..."...(.............@..@.data........`K..J...FK.............@....qtmimed......K.......K.............@..P.rsrc.........P......~P.............@..@.reloc...|....P..~....P.............@..B................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5DBus.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):345072
                                        Entropy (8bit):6.69347328565263
                                        Encrypted:false
                                        SSDEEP:6144:p7/XsDKD1OjnMFTZNgWoVEC8FMVU+SBF5h10xwSfdGX+Asf5YVJ:p7/XsDKROjQN5oVEvcU+SBvh1C5UJ
                                        MD5:431E75DD83B3B2FF1954300CC7F43060
                                        SHA1:44857528CEEA89420FFCCA97558A655B0B10849C
                                        SHA-256:B9BCA43F52D5BFBF014D1C2643516B54EEBB5B07D1DFCA8F4C266628EF9D121A
                                        SHA-512:D299B08393C5DD2064CF53CA52F2754EF16D075BF3C549A3EE212908F7537287C0ABE464EA54528B370B554993981DC2BA7C47CA300D6AA8CEB21BC847069B84
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................V.............3......3......3.......3.......~...........+...~......~.......~.:.......R.....~.......Rich............................PE..L...H._...........!................%........................................`......f2....@..........................$..0l...........................(...........H..D...T...................P...........@...............P............................text............................... ..`.rdata..H>.......@..................@..@.data...$...........................@....rsrc...............................@..@.reloc...H.......J..................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Gui.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):5894128
                                        Entropy (8bit):6.78187184482046
                                        Encrypted:false
                                        SSDEEP:49152:FKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cQ:wUKssPdOy/tZWnXThVc5tnB6NDrd
                                        MD5:5B0F3D5B1B29B5E650375093C7AFA243
                                        SHA1:1920CBC98BD46A3A72BCFB45CAEFCFA2649A92E6
                                        SHA-256:80016776EFEA2B2A838C3FFA4C82E5F146BAFF68C36073C0C34668809D1C4297
                                        SHA-512:9DB9A90AB5A1A768E079CF9B10F1DA868AC7DAE774E90E139EE047C9C8FB43CC5B3E01AE3724EA74EFD64409EEEAFBCDA4F04DA3E86265575A3831A4FC69CC8C
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hd.d,.q7,.q7,.q7%}.7:.q7.ju6&.q7.jr6 .q7.jt65.q7.jp6(.q7.up6..q78nt6-.q78np6!.q7,.p7G.q7.uu6<.q7.ut6E.q7.uq6-.q7.u.7-.q7,..7-.q7.us6-.q7Rich,.q7........................PE..L....._...........!.....V6...#......L6......p6..............................pZ.....;.Z...@..........................%=.0"...GV.h....0X...............Y......@X.l!....<.T.....................<.......<.@............p6.|............................text...zT6......V6................. ..`.rdata.... ..p6... ..Z6.............@..@.data...,....@W...... W.............@....rsrc........0X.......W.............@..@.reloc..l!...@X.."....W.............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Multimedia.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):593392
                                        Entropy (8bit):6.548929192441609
                                        Encrypted:false
                                        SSDEEP:6144:UbF/85xSKprGjwf+DC9rSBke4ki3MHun9ygXa4KPno+/+lt6h3kocBln3ShKjJm4:fcwI5kaUKvouh0FBF3SoJS72Jsy
                                        MD5:091CD90206794A3EFF2C16F8747A47D1
                                        SHA1:E23E9CEA6A8DEAE8CC143AB748EC9E84F8205FCC
                                        SHA-256:916653DE6EC324A156A49AF83D11B17B7E338E97D8DB629D5A8BE8B57E0EA639
                                        SHA-512:60ECE4153E335FB90D712CF0C5CC2D22B1324BC92FA37B2CEFFA5DED5CD76C227259BBB7B8DCBBE6B026876D13101EF7BD92422292BD08736DAE91641DC978C5
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... M.Gd,..d,..d,..mT..l,..pG..f,...C..q,...C..n,...C..b,...C..`,...\..c,..d,...-...\...,...\..e,...\s.e,..d,..e,...\..e,..Richd,..........PE..L...a.._...........!.........r...............................................0............@......................... ...d....+...................................l......T...............................@............................................text...Z........................... ..`.rdata..............................@..@.data....$...........`..............@....rsrc................~..............@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Network.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1051120
                                        Entropy (8bit):6.670752367944595
                                        Encrypted:false
                                        SSDEEP:24576:Aul0ktv339DOBVXaIFP698DWk7PVmr0qwjb:A8sJVWAcwnH
                                        MD5:2E3DB1CD1EC59D08706438258E86EA30
                                        SHA1:BC20B1E40049386E6BEA3F448A6852BC879A8821
                                        SHA-256:37275F3EA79D15A2792BF21F71F1DF825F201CF8B33AA1F94CA93D62D76B216C
                                        SHA-512:0C0E0E02CCADC3F2B3F6C8CBF2C162FB73734B0B244C80048968A6FE268450A270A3F92B155DAF6268FEF246D26AD417E6CEC224133FD66E6FFB3A5394B04358
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G;.x.;.x.;.x.2...7.x./.|.:.x..|.1.x..{.>.x..}.".x..y.?.x./.y.5.x...y.8.x.;.y...x...}...x...x.:.x.....:.x.;...:.x...z.:.x.Rich;.x.................PE..L...z._...........!................Q..............d.........................0.......k....@.........................0...<e..lT..T....@.......................P.........T..............................@...............4............................text...?........................... ..`.rdata..............................@..@.data...L8.......&..................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5PrintSupport.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):267760
                                        Entropy (8bit):6.863402731081147
                                        Encrypted:false
                                        SSDEEP:6144:4Pt7KN5BjAMaTwmGyjh4C6Qiy8AoUL37fhcJ3I9VHHiy1Qfcz+IQlGXxDF4li7cn:4lE5Bj+Kyj2mF8kFOfkDe
                                        MD5:83FB40D5AB3108F18832B78574404B62
                                        SHA1:0F6AE59CA205CA75A8ECF02D0E0ED5203F894685
                                        SHA-256:74E737DDA4F666C28F9543BDE9CEE526A18D0088A780B497AD7C1772B3CADD4E
                                        SHA-512:8B9763C3AE94178A350E355F436BCC8B1802064EB2E968327AFA423688035C2AA3AE7989CB4D0F61231E1A7AEE86A2635626CCDCFCEECA3058D99520F4E38D1A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............|..|..|.....|.O.}..|.O.y..|.O.x..|.O....|..}..|...}..|..}..|...y..|...|..|.....|.....|...~..|.Rich..|.........................PE..L....._...........!.........b......Q........................................0............@.............................o......................................d0......T..............................@............................................text...z........................... ..`.rdata..............................@..@.data...l...........................@....rsrc...............................@..@.reloc..d0.......2..................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Qml.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2975216
                                        Entropy (8bit):6.4996884499926635
                                        Encrypted:false
                                        SSDEEP:49152:grHpbRcgtgEgnLDYZeQok3e3QiBMKbjcbKYI1YLTFXrwWGw6cTWptNrSdSG779LZ:ARcgOnLDYZeQokwuT5E7NrSdSG779LL9
                                        MD5:7CDA5037206A57CADD50B5F032876A8E
                                        SHA1:314B671B27E9602A66396EC37BDD6E70BB180D92
                                        SHA-256:E45F26EBBC2B0499E0E90F1666FD13F1BB2BED1073E828D30B6A3A70599D4BC9
                                        SHA-512:1450A79B017B4809C83C2FC4EF53DF926E3A725959B6E378C5A55C853D2151A2BA70272848962931C58596FB4174601E3DEFEDB120FD0A211D57BE9D1908EE3E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9V..jV..jV..j_..jZ..j...k\..j...k]..j...kJ..j...kR..j...kR..jB..kS..jV..j..j...k...j...kW..j...jW..jV.{jW..j...kW..jRichV..j................PE..L......_...........!.........X............... .....f..........................-.....I.....@..........................J$..`....).......+..............J-.......+.$.....#.T.....................#......#.@............ ...............................text...j........................... ..`.rdata...`... ...b..................@..@.data...t>....*..&...n*.............@....rsrc.........+.......+.............@..@.reloc..$.....+.......+.............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5QmlModels.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):350192
                                        Entropy (8bit):6.598734428040625
                                        Encrypted:false
                                        SSDEEP:6144:hX6wb2uBTVgttAC/trZYzAZpebGUvteg0NYMr7XPqfQ3G/7fOTvFmqi9:3BVgXt9EAUGUQg/MfXQ0m/9
                                        MD5:78E8091FEB2E6CE5646459DB0EA9E465
                                        SHA1:1731D2D47CFE21394F208F7BAFF7EA1F2E702546
                                        SHA-256:065C8D687DC74964123F4BB06319565B163B164AB09DADC1EB6929EE19755735
                                        SHA-512:B3FDF745336C7473B9AFA57432379FF32CA5105EB956779DA16DE3CD55453AF54E1420E5F514A1BD9F78107DAD4EF719089640CFD0F144D8B7A36E3E39E319D5
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+c..o..o..o..fz[.i..{i.m...m.y...m.e...m.j...m.k...r.j..o..9...r.|...r.n...r7.n..o._.n...r.n..Richo..................PE..L......_...........!.....|..................................................p......^y....@..............................[..Lm....... ...............<.......0...?..D...T...................P...........@...............X............................text...k{.......|.................. ..`.rdata..ZT.......V..................@..@.data...."....... ..................@....rsrc........ ......................@..@.reloc...?...0...@..................@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Quick.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3489776
                                        Entropy (8bit):6.735327359739455
                                        Encrypted:false
                                        SSDEEP:24576:wLAgn4tj+U6JL9iji/2LzruK/bEdKUEAWzeauejEM5OmTi/bIi6+LPt1rt83FCbW:zT1HZEHr7OCsKbKzVZPXMC0FEUO71
                                        MD5:07266E7D049AC4499F34CE281F3A50D7
                                        SHA1:257968090B95FAE67F92F82DB9CAB1F7613D75E3
                                        SHA-256:5F246016691FF883243EE9B3C9215EB16B859B12AEFC5F4BBD2FBDA3911883DE
                                        SHA-512:D7F9CE2FB11DE178D6D38A5580C503C21FED6777067B8A8259F9FE35B44047040B705903DB4ED3FBAC821806CBD5CA1DB0F5FCBEC68CDC49282DC0E63A3257C3
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&{.&{.&{./.p.*{....,{.....!{....?{...."{...,{.2..#{.&{.p....{...'{....'{.&{t.'{...'{.Rich&{.................PE..L......_...........!...... ........... ....... ..............................`5.......5...@...........................(.._..pT/.@.....2..............$5.......2.......'.T.....................'.......'.@............. ..............................text.... ....... ................. ..`.rdata........ ....... .............@..@.data...d.....1.......1.............@....rsrc.........2......~2.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Svg.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):264176
                                        Entropy (8bit):6.70077376714061
                                        Encrypted:false
                                        SSDEEP:6144:71lj55OgW5ODJ+bXhE4o+K08LJw8Rk8bOvR1yGaucmSJyUIEDv8ma4y4GeO43iUM:7bJ+bXK4o+K08ROvR8ucmSun5h
                                        MD5:EF0D5A2DC1D7A921F2BB0EB3EEF2E481
                                        SHA1:CB167EC49221EC5245FD9BFF7E7EED6C7CF38D51
                                        SHA-256:ADE28D4CBAC1E033468CB48F380352F0DF7FBBCE03261C48827B8A5ED7A1548E
                                        SHA-512:ECB41CB9BC4A4470F039D02441A0C0E8C596FFD55DEB924E516C4C8FC880357D5D2D1EF36E63B1303FAA7DAC5C921679A0F405C39F6E0B32B3746C972653B789
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..j.o.j.o.j.o.ck..l.o..|n.h.o.~xn.h.o..|j...o..|k.`.o..|l.i.o..cn.m.o.j.n...o..cj.g.o..co.k.o..c..k.o.j...k.o..cm.k.o.Richj.o.........PE..L......_...........!.....T...........\.......p.....f......................... ............@.............................@}...<..................................8/......T..............................@............p..\............................text...{S.......T.................. ..`.rdata..NL...p...N...X..............@..@.data...............................@....rsrc...............................@..@.reloc..8/.......0..................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5WebSockets.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):122352
                                        Entropy (8bit):6.478532411200339
                                        Encrypted:false
                                        SSDEEP:3072:v2w9BY91mB0E7PH4r+/yr5Cmwk7FyM0DO2:v2wPPHwhwk7FqJ
                                        MD5:60BF6B69FB580B6F719394AA8277503C
                                        SHA1:CB37BAF5B1648B805A07E0DEA59C3A0A65345835
                                        SHA-256:B8F83F5E56622AFCC257FA6883AD2DDC24934F21619037DDC637C691ACB80F33
                                        SHA-512:64CED39966851953B5ACB6769DA72AD6AB19E2D42515B6ABD0F6F1EDC621137E0451604E5EF95C228065C54463D2AD4BA0707984AA516FEF6F8C72D04DCB94D9
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3+E.]xE.]xE.]xL..xA.]x..\yG.]xQ.\yG.]x..XyP.]x..YyO.]x..^yF.]x..\y@.]xE.\x.]x..XyV.]x..]yD.]x..xD.]xE..xD.]x.._yD.]xRichE.]x........PE..L......_...........!................&...............................................@.....@.........................`5...!..0W.......................................)..T....................*......`)..@...............4............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\Qt5Widgets.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):4459504
                                        Entropy (8bit):6.83333130328421
                                        Encrypted:false
                                        SSDEEP:49152:ypo1FNXS+dh75PMvZZNNt+iIo5uL5Sdbtye6cEu0n:oIPqZZUfwusae6ju0n
                                        MD5:DA70580648A398AB1C5336EE9EC631CA
                                        SHA1:FA67A8A2D7F7930A45974DCB7A12E56914BF0A57
                                        SHA-256:600285754E7EEE7239B9D252DBED5C9D2C9C4C432751B8953DCB2E8B45E0408A
                                        SHA-512:83D85DF1717A5B1DD5B31F5AB33E73D1442027A719AF7FDCD20D578598F436D63E7CF58287CBE34DBEE8D5B0464A68DFD471D8EC6A95A3168EB8639864A7ADFC
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........t..t..t...:.t..W...t..W...t..W...t..W...t.....t.....t......t..t..x......'t......t....V.t..t>.t......t..Rich.t..........PE..L....._...........!......*...........*.......+....e.........................0D.......D...@..........................Y6..'....>.T....`A...............C......pA.`....o5.T....................p5......o5.@.............+../...........................text...:.*.......*................. ..`.rdata..j.....+.......*.............@..@.data....w....@..r....@.............@....rsrc........`A......4A.............@..@.reloc..`....pA......:A.............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\d3dcompiler_47.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):3466856
                                        Entropy (8bit):6.444422172074855
                                        Encrypted:false
                                        SSDEEP:49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
                                        MD5:C5B362BCE86BB0AD3149C4540201331D
                                        SHA1:91BC4989345A4E26F06C0C781A21A27D4EE9BACD
                                        SHA-256:EFBDBBCD0D954F8FDC53467DE5D89AD525E4E4A9CFFF8A15D07C6FDB350C407F
                                        SHA-512:82FA22F6509334A6A481B0731DE1898AA70D2CF3A35F81C4A91FFFE0F4C4DD727C8D6A238C778ADC7678DFCF1BC81011A9EFF2DEE912E6B14F93CA3600D62DDD
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.X.0.X.0.X=.DX.0.X=.EX.0.X..DX.0.X..FX.0.X.0.X.0.X..@X.0.X..EX.0.X..AX.0.X..XX@0.X..BX.0.X..GX.0.XRich.0.X................PE..L...n..R...........!......1.........7.0.......1..............................`5.......5...@...........................1.u... .2.d.....2.@.............4.h<....2....p...............................h...@.............2. ............................text...%.1.......1................. ..`.data...<.....1..^....1.............@....idata........2.......1.............@..@.rsrc...@.....2.......1.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libEGL.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):23024
                                        Entropy (8bit):6.3575722696909756
                                        Encrypted:false
                                        SSDEEP:384:BH0ECfljwSVn5jd2J5uIVndDGn7Dgf2hOi:BtCZn5jMruIFdDGn7Uf2hOi
                                        MD5:371AEB50F7816108B346B67EF2B11E1A
                                        SHA1:5DE780B46D7663D1615727EDABA32B5709286D38
                                        SHA-256:12903D93A7F57B479401602A533849E6F813FF5C2C92F3A02D468FC98E7AC1D5
                                        SHA-512:4AFF94ADBD97948766C7839220E15000A4DEFB7D46B5502872B16225E8C5B85B6B674B632455AFBB3DB729D5F2E9666B32B8DB282EA3499EBD84FE4CE11D9631
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u......u...t...u..t...u...p...u...q...u...v...u.E.t...u...t..u.E.p...u.E.u...u.E.....u.......u.E.w...u.Rich..u.........PE..L....._...........!.........*...............0............................................@..........................5.......>..d....`..H............>.......p.......1..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....rsrc...H....`.......6..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libGLESv2.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2937328
                                        Entropy (8bit):6.526679153933017
                                        Encrypted:false
                                        SSDEEP:49152:OOs7dcfIlADvQs46Bw6OtkrSjfM0E66+k:cdcuA8s4Fte
                                        MD5:7FF6836C626BBC7F0833A66AA77A7A7F
                                        SHA1:9AD21C1A5DF940999BA9F884D21868D3B69E7155
                                        SHA-256:8CFC024D09A6784486DA7DC0EBFD90C0C8136B27C08EC1C3F352CD4FA43B9273
                                        SHA-512:8FF378B9D2A1058396FF5E9795F7BD25FC3092F94B9274447C849C19294569197F6920BDA448A3E2C06B012BA1468D75F2B26ED1BD4E54191F28CA209BF41697
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M6M.#eM.#eM.#eD..e].#e..'dG.#e.. dD.#e..&dV.#e.."dI.#eY."dJ.#eM."eO.#e.&dC.#e.#dL.#e..eL.#eM.eL.#e.!dL.#eRichM.#e................PE..L....._...........!......"..&......}. ......."...............................,.....;a-...@...........................*..\...l*......0+.P.............,......@+.t....'.T....................'..... .'.@............."..............................text....."......."................. ..`.rdata........".......".............@..@.data.........*......|*.............@....rsrc...P....0+.......+.............@..@.reloc..t....@+.......+.............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\libeay32.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1297408
                                        Entropy (8bit):6.797045895691215
                                        Encrypted:false
                                        SSDEEP:24576:VUT+idPQfrZSZ9is0eiJUHV3fMPmBH0K6gElgzx9KlHGMQ7PHnq51FdZoYff9:EiZSZK2jHd6lHGMQ7PHq/XZoSf9
                                        MD5:732928B0091928B1DCCA5AD7D908E58D
                                        SHA1:E2D52810BA6C665A75ACE33DC1D963123A6A50D7
                                        SHA-256:C28EB9E000A4232F918A88159FCF376FD4EBE706024DE86DE4E371433859D320
                                        SHA-512:5CFF31C15BA76375FFA1E1C908177DC4AE5BC83E8488EAA2D73D9C98BD96A758E15180C1F3DD6928A6D22259477AA6449359CB2DF9589D5201781AF07A1091A9
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8o..|..I|..I|..Iuv+Ij..I.f.H~..I.f.Hv..I.f.Hv..I.f.H{..I.j.Hw..I|..I...I|..Ii..I.g.H<..I.g.H}..I.gGI}..I.g.H}..IRich|..I........................PE..L...;..]...........!.........j............................................... ............@.........................0...........h....p..H...............................T...........................(...@...............t............................text............................... ..`.rdata...>.......@..................@..@.data...t........`..................@....rsrc...H....p.......&..............@..@.reloc...............,..............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\opengl32sw.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):15995904
                                        Entropy (8bit):6.353584600934879
                                        Encrypted:false
                                        SSDEEP:393216:rNkEXgt/UOdyRLjqkmbBDrta60HYUnuedxO0g//NuPyEMO32ovq:rN1QtXdyRLjqNbBDrta60HYUpO0Q/NuZ
                                        MD5:8B197F55264A44B7B25046F7BA5BD7D2
                                        SHA1:CEF69E168160968E00FFFFA136E1AF7819E7C0CE
                                        SHA-256:25AE7577E066FA80519A8F1C314B15CDD22E4A8D3ECD2A36ECCC79E40714A91D
                                        SHA-512:6AF2B1B17A7E3460099359A6750221AACB8F9CE0E80B346DBAFD2CBD8E579543B980F98E0AEB199E0781A045C9D6A7F2F11C8628F960C13550328487B7FA9154
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l%..K...K...K.......K.......K.......K.;.....K..PH...K..PN...K..PO...K.......K...J...K..PO...K..PN.I.K..PC...K..PK...K..PI...K.Rich..K.........PE..L.....`W...........!..........H......D....................................................@..........................v.....t...........................................T...........................X...@............................................text............................... ..`.rdata....<.......<.................@..@.data...pp... ......................@....gfids..............................@..@.tls................................@..._RDATA..............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\bin\ssleay32.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):281600
                                        Entropy (8bit):6.362792344200413
                                        Encrypted:false
                                        SSDEEP:6144:yqQcCHyQdCb4R7sUHmDP/Cl3QmedVi3fL3ldtQBRdrQJq7av4vX0WezQ0RYA+Ooz:jQcCHyQdCb4R7sUHmDnCl3QmedV2fL3w
                                        MD5:5856074EE91B0F315E2C436F306EDA09
                                        SHA1:42A222BC006E14E9C2DDBFE6197D201EC842B557
                                        SHA-256:F15F2E0484BF015856FAAD6AC54CB4A6E8751806C8A9644DA32BD58F9C55521B
                                        SHA-512:7D9D0C6D15887F935A0AB4034912A147CB0E47A8208009A7310874271502F691EEB86DE184A0CF3E32C6999CC6BF8A2FFC629E0015E9C2A0DCAABD39617E7151
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P4+N.UE..UE..UE..-...UE.F=D..UE.{1D..UE.F=@..UE.F=A..UE.F=F..UE..<D..UE..UD..TE..<A.&UE..<E..UE..<...UE..<G..UE.Rich.UE.........PE..L...P..]...........!.....,... .......5.......@............................................@..............................).. ........P..H....................`...%......T...............................@............@...............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data...D1..........................@....rsrc...H....P....... ..............@..@.reloc...%...`...&...&..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):89072
                                        Entropy (8bit):6.536218125453265
                                        Encrypted:false
                                        SSDEEP:1536:uLAHXpkWC/CkCvCFCiW124BuTU8lF9+f7BdtenWWM11oD+k0B+C4f09IPKkwYrYK:uLAHXpkk12LU8r9+jBdteBh+k0B8fZPn
                                        MD5:A3CE61417B3D6049B14BD6E07642FA41
                                        SHA1:A0A82923F6B6455BE5644E33F2B6E5365CF8D4E7
                                        SHA-256:2961E1C94FD641312B7747A9B2D07F05B420C5C68C29242283F1B7F182E427A2
                                        SHA-512:91312A776D48B801CE946A8448F73549686CEA1201C7E21DBC41E972DDBBDD2CDAEE2E255BA3B3B961E70306CFE00BEEC2664EE6AA872073896624CE4C3E757D
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.H.4.&.4.&.4.&...".>.&...%.1.&...#.,.&...'.0.&...'.0.&.=...>.&. .'.3.&.4.'...&...#.=.&...&.5.&....5.&...$.5.&.Rich4.&.........PE..L......_...........!................................................................V.....@..........................................`..P............@.......p..........T...........................8...@...............\............................text............................... ..`.rdata...T.......V..................@..@.data........0......................@....qtmetad[....P......................@..P.rsrc...P....`....... ..............@..@.reloc.......p.......$..............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\audio\qtaudio_windows.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):53744
                                        Entropy (8bit):6.514657800964626
                                        Encrypted:false
                                        SSDEEP:1536:JymY3USpNcShD+t9QS6bkZYKrChimrJvFUfw:kmY3UsVI9H6xiChim1v/
                                        MD5:88577BFC1A8F34CBF575205DB3F1CB31
                                        SHA1:CB9D72FA0DD97CD4008015551CC5764C9BE328C7
                                        SHA-256:868C105861B6FB2207997A9B13D52B8CC0A22CE37D63382A869FD33277526213
                                        SHA-512:4C3D65ADFAEE850E40F2725FCA62A11F3B6652C8ADAD2E7372222E53F77C538A1904B4A7ED6DF8167DD08D6BAC628160CAA3EB5906673D2F9A467947D85C45B8
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0../t..|t..|t..|}..|r..|..~}v..|..z}a..|..{}~..|..|}q..|.~}p..|`.~}}..|t.~|...|`.{}v..|.z}s..|..}u..|.|u..|.}}u..|Richt..|........................PE..L......_...........!.....f...P......%l....................................................@.............................|...............P.......................@...\...T...................h...........@............................................text....d.......f.................. ..`.rdata...6.......8...j..............@..@.data...............................@....qtmetadb...........................@..P.rsrc...P...........................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\bearer\qgenericbearer.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):44528
                                        Entropy (8bit):6.480493686402605
                                        Encrypted:false
                                        SSDEEP:768:EYnMoTheMJroMOENIFanla6PK2Jbga+5+yAXmjkJuDZbjV52dDGFeTUf2hl:Xhe8O6QalaYbga+PjkJuDZbn2VTUfy
                                        MD5:57F3FFCF6A99ABDECA93D0BEBD9F05D8
                                        SHA1:F1B7038C4F6CAD75B8A6D115255421D60F1DE04F
                                        SHA-256:44B59C980CA26ACA133BD3842155C55EB30630853C3C316E1955415E10B34C0F
                                        SHA-512:CBE0ED19D03540FFEF93C4028BA7BF170CA82D1BFD15D432C7FB0EDF96E450C9DDD85701B3EF52EDABAC96FD3CB6E3DA2EADF4ED1DE3907E986E8F3D64DD3B08
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Dq..*"..*"..*".."..*"m.+#..*"m./#..*"m..#..*"m.)#..*" .+#..*"..+#..*"..+"..*" ./#..*" .*#..*" .."..*" .(#..*"Rich..*"........................PE..L...H._...........!.....D...L.......J.......`......................................;.....@.........................Px..|....x..........P............................n..T....................o.......o..@............`...............................text...DC.......D.................. ..`.rdata...7...`...8...H..............@..@.data...............................@....qtmetadj...........................@..P.rsrc...P...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):58864
                                        Entropy (8bit):6.60633814610451
                                        Encrypted:false
                                        SSDEEP:1536:QNa1alH+mupJQnk4RBWaDMGRZPwa3CocG4jUfV:o3lH+QDMGRZPwq4c
                                        MD5:CF779FF4BAD071CE54550437A2730955
                                        SHA1:2EAF309EA638320BCB9A775C748E294DA57ACDED
                                        SHA-256:D132BBE8ED3EF8288B7089366F5DAF8AD732354A051BA661406BD57734C18FFA
                                        SHA-512:5C7384C0EA4271193F88B31A1DCD28A9C74065163DEEBF85D891F0832A285871E8A867794FFFC79B50AD9F4D93CCE56B2A3BDDDA86160499D5BF8EF5918AA6CC
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(kL.l.".l.".l.".er..h."..e#.n.".xa#.n."..e'..."..e&.f."..e!.n."..z#.k.".l.#..."..z'.i."..z".m."..z..m."..z .m.".Richl.".........................PE..L...A._...........!.........J......*...............................................1U....@................................P...........X...............................T...............................@............................................text....~.......................... ..`.rdata...1.......2..................@..@.data...T...........................@....qtmetadi...........................@..P.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):35824
                                        Entropy (8bit):6.522245949878045
                                        Encrypted:false
                                        SSDEEP:768:crdZm5mjw1lQR8Z3Zf3V+hFem0wKk84XmydDGFUf2hE:6u1lQQ3Zf3V+Lem0wKk849kUfP
                                        MD5:A85EA17FB2CA9258E71D0A60667EAE6A
                                        SHA1:9BC4333321611769A51BCB5292C0517C227614C6
                                        SHA-256:5456152400A84C153728007BD1C7D549788D2300441ADDD40C18D7E17F757856
                                        SHA-512:EAD8A715F75C82FE85A2D475010D8C880B13700C847840810BD6F75F6A4A418DED406133404A1C3D196461D676F8819A7BFF25E556D25250D031E513303F81EB
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................................B.........X..B......B......B.v....B......Rich...................PE..L......_...........!.....8...8.......>.......P............................................@.........................0]..x....]..........H............p...............T..T....................U......0U..@............P..x............................text....6.......8.................. ..`.rdata...%...P...&...<..............@..@.data................b..............@....qtmetadj............d..............@..P.rsrc...H............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qgif.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):34288
                                        Entropy (8bit):6.411504035676847
                                        Encrypted:false
                                        SSDEEP:768:aL5MPkjurnzyuVlfehyScQeOYGuOU9OOHhTNAYFdDGzUf2hW:aNYnzyuLeEfQeFGuOU9OOHhZAYFOUf5
                                        MD5:E3A1338EFADABB9FC23D955AF9A7E070
                                        SHA1:DFBE82B183FFF002A2E841D73474C78F646FDBA2
                                        SHA-256:F1FA3BFEEA6A600F2C6D209775154CEE349B7F687CB4F7213A8CAD8870DBB812
                                        SHA-512:0413A6116E227FA6A3DD7DA6FA4BB8DB59ED64FC16E37BFA49CA28C687FE791941B3A23193796EB0ECE458E87F9F78F587B3A1FE0F188B63B9148037997DF1A2
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O)..!z..!z..!z..z..!zh. {..!z.. {..!zh.${..!zh.%{..!zh."{..!z%. {..!z.. z.!z%.${..!z%.!{..!z%..z..!z%.#{..!zRich..!z........................PE..L...1._...........!.....:...0.......A.......P.......................................=....@.........................p\..t....\..........@............j..........d...$T..T...................0U......xT..@............P...............................text...t9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......\..............@....qtmetads............^..............@..P.rsrc...@............`..............@..@.reloc..d............d..............@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qicns.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):38384
                                        Entropy (8bit):6.558386736803828
                                        Encrypted:false
                                        SSDEEP:768:nwFo5IoYXrOOmYaRCNOq9QNdhVJ0hBEH3lMwAJXGdtpZmPdDGGzUf2h2:wWBIf9QvJgEX6wAJXGdtpZmP3UfP
                                        MD5:862A826020DFE7AB690900A87250992D
                                        SHA1:983117858F162F7EAB3F4AEE6E0D9619E20637EF
                                        SHA-256:F96E413DC1B8A67C025B3D1769241EE96DD8B079B367A6C868D650A6B68154C4
                                        SHA-512:A71CDFBA3023934D0BFE25A05D2FDA00F60CAAF77122CC0D52C7C6F6555EBF43E13555B563A564023C02E9419471A8ED325D182508AD276517C68C9691D5704A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pj..4...4...4...=s5.2....d..6... `..6....d..'....d..>....d..6....{..1...4........{..6....{..5....{Y.5....{..5...Rich4...................PE..L......_...........!.....:...@......jA.......P............................................@.........................@e..t....e..........@............z...............\..T....................]......@]..@............P..<............................text....9.......:.................. ..`.rdata...+...P...,...>..............@..@.data................j..............@....qtmetadx............n..............@..P.rsrc...@............p..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qico.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):32240
                                        Entropy (8bit):6.4704292078665375
                                        Encrypted:false
                                        SSDEEP:768:1wLKUeP1ob4OgufLCJGqU2SZ6HseQdDG0Uf2hKT:4KUeP1WyufLCJGqU2SZ6HseQ9Ufz
                                        MD5:7200F8E1AF1C6A60501D5FEF7772FD0B
                                        SHA1:5F2BAC81A60F7FDFBE8B1A01F111660A3614D679
                                        SHA-256:35CF0AE6BCD1B8322482D40BF2DD693E276548885284B88E6631AB18A0C2C60E
                                        SHA-512:097835D4C8C61C2489E831B31A8BB6F2FEEA277439D6697B6E3165CCB6E4758986C9A1FA754696DA53B6005A041156FF8BC455A71DC31EA799F5891348A07F22
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.O..d!..d!..d!......d!... ..d!... ..d!...$..d!...%..d!..."..d!.. ..d!..d .d!..$..d!..!..d!.....d!..#..d!.Rich.d!.........PE..L...1._...........!.........4......;4.......@............................................@.........................`M..t....M..........@............b...............D..T....................E.......D..@............@...............................text....,.......................... ..`.rdata...!...@..."...2..............@..@.data........p.......T..............@....qtmetad.............V..............@..P.rsrc...@............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):374256
                                        Entropy (8bit):5.647982656907108
                                        Encrypted:false
                                        SSDEEP:6144:QsC804cB4tEXoOitMk5R8vsLK0LXz5pmglF90l7s0aGajl8Z9cg:Qr4bOzk5R+s5LFg9cg
                                        MD5:438B696A9811CD821BBE2C54B5C1B4B1
                                        SHA1:55EB74A0015228B1E6C1DC97E6F427C9DC804587
                                        SHA-256:84C23191B5E35EAF899358C21445A5377845C0653668BBD99B1AA8796E0248C7
                                        SHA-512:961ED9CFCD61A1FC32DE89CB97100AAA9A9225C80673B2176975BF62AF7F3A0E77A91FB723ED52C553E10A6F754A5E8C8085BDFBD56EF2DE8144C53BF41F4E91
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a(a.%I..%I..%I..,1../I...&..'I..1"..'I...&..0I...&../I...&..!I..9.. I..%I...I..9...I..9..&I..9..$I..9..$I..9..$I..Rich%I..........PE..L...X._...........!.....................................................................@......................... u..t....u..........@............................l..T....................m...... m..@............................................text...$........................... ..`.rdata..(...........................@..@.data...............................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qsvg.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):28656
                                        Entropy (8bit):6.306194975087341
                                        Encrypted:false
                                        SSDEEP:768:WV5VVvwZ12uh991MD9dhQwe+oQQUcesJbT73dDG5Uf2hg:IvwZ12aC9Qwe+ZQUbsJbTLwUfX
                                        MD5:F304A2C8067F804D25B98D360E92829F
                                        SHA1:DAE1D07DE8C33912FF4FFC957F8817B2B3E8293A
                                        SHA-256:E45893BB7DB31BFD32E87DC7A6B02709FCA36EB83A25AEDC45A39178EC80051E
                                        SHA-512:5BC122BEA8DE687820932666C6B76BB153B115263B31A40FD7823A2A36EBC88B27626E06E3A6C5DC5F62970C8C7E9C094984B494D7F279BFDB9BAC7A8C2964CA
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................B........D...B.....B.....B.u....B.....Rich...................PE..L......_...........!..... ...4.......%.......0............................................@..........................<..t...T=..........@............T...............4..T....................5.......4..@............0...............................text...T........ .................. ..`.rdata..h ...0..."...$..............@..@.data........`.......F..............@....qtmetad.....p.......H..............@..P.rsrc...@............J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtga.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):27632
                                        Entropy (8bit):6.3327508725091315
                                        Encrypted:false
                                        SSDEEP:384:kg8gKOwVg6VjbFnOfEIzPMoVhWyrsdnyBSxQrrVIyndDGdEDgf2hR:kPxOQXOfEnoVh5/BSxQrxIYdDGKUf2hR
                                        MD5:367C723591FDE64C38202D4C0F5ECFDE
                                        SHA1:C13D74F417601C656F343F00D15E56517EE03B6A
                                        SHA-256:CCD620E74045D9C9157903120140B97419CBBE91FD43337E640C67CD4522072A
                                        SHA-512:31C084BA00E094E30C6F912ECD045E19C4451D8783A80DC99B99098F84C5500665A35AC901B0FDE84D04DF898AD67448E83539A7DAA4928E8C78F798B359B256
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...d.....`...v.`.....p.....h.....a.......g...b...........a.......c.....b.c.......c...Richb...................PE..L......_...........!.........2.......$.......0............................................@.........................`?..t....?.......p..@............P..........(....5..T....................6......(6..@............0...............................text...d........................... ..`.rdata.......0... ..."..............@..@.data...L....P.......B..............@....qtmetadu....`.......D..............@..P.rsrc...@....p.......F..............@..@.reloc..(............J..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qtiff.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):353776
                                        Entropy (8bit):5.798077806376592
                                        Encrypted:false
                                        SSDEEP:6144:BpYIdJpn0zXsT6DP64icIkjEkaNCTjM+8kBHWNFnHJXGFkDQDWr:jYIp06+IkjeNGjIkZZKr
                                        MD5:49B6F0BA901F649AB110744E34076951
                                        SHA1:4C9EEBADB5B86147EA94F48EAA6705A4B75B3E61
                                        SHA-256:5128AEDF4BD9B747AC848BF85E0FFB99BA814BD8E671ADFF7D26391D31259050
                                        SHA-512:B42A13F0215A194F77781AC74CF55C24A0F0BC99CC872EA06125CFE12FFEF93ADD0665991339DB3B7962262E6D381F20227DA3272360450B53993D06BC0EC98A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................5...F..........F.....F.....F.............&......................Y.........Rich...........PE..L......_...........!.........^............................................................@.............................t...4........P..@............J.......`......d...T...................p...........@............................................text...$........................... ..`.rdata...........0..................@..@.data........0....... ..............@....qtmetad.....@.......$..............@..P.rsrc...@....P.......&..............@..@.reloc.......`... ...*..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):26608
                                        Entropy (8bit):6.424614950505374
                                        Encrypted:false
                                        SSDEEP:384:j9NLeETizwsASWjsUE2rBiQtp4VmsdXurvZJ4EndDGgDgf2hcU:xNLXiHAS+E2rBi7mbrvZJPdDGgUf2hcU
                                        MD5:7A05C8435FB60F43958120B22B653B54
                                        SHA1:79D7122E4AB89DC9978FCD48FCBF0C6B8AE3F690
                                        SHA-256:7C946F750413716A714884C8836D24AA6D2561B48E7F3397BAB88AF348E078EC
                                        SHA-512:74800A623E4789C245095B6AD0CC03EC8EB00431487E7977BD3BC5CBF0278480474D74FD194873F220DD5682EEC88864095659315F68D650C1CC8B40435B182C
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D.D.D.<r..D.Q+.D./.D.Q+.D.Q+.D.Q+.D..4.D.D..D..4.D..4.D..4...D..4.D.Rich.D.................PE..L......_...........!................[%.......0.......................................\....@.........................P<..t....<.......p..@............L...............3..T....................5......P4..@............0...............................text............................... ..`.rdata..^....0......."..............@..@.data........P.......@..............@....qtmetad~....`.......B..............@..P.rsrc...@....p.......D..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\imageformats\qwebp.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):412656
                                        Entropy (8bit):6.72175950156531
                                        Encrypted:false
                                        SSDEEP:12288:llTSf8S+PHunhrYzVcS/CQVy7wycv+QrUwDHHgxgG:L08S+PO1OVcS/XVykyI+4M9
                                        MD5:B9416990AF043CA8CFA668121184C05D
                                        SHA1:4181D92E91704B961A22B51713705D53DDA0CF51
                                        SHA-256:50FCF1FED7612AE4C346D7AE7DEC3EBBBD2AC31C5E954263A7BBC655502E3B03
                                        SHA-512:E303E4B166ADA78DBE75639B73EFE275A0E4F49A1CD2DA5016E1F31A1A012AEE383E6ACC21D63561E78321B1E162EC9CFEC3915909E698D2064B1FB0DD33DE76
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............gY.....p.....t.....p.....p.....p....Yo.......K..Yo....Yo....Yo....Yo5....Yo....Rich...........................PE..L......_...........!.....`........../h.......p......................................6b....@.............................t............P..@............0.......`...#......T...............................@............p..L............................text....^.......`.................. ..`.rdata..t....p.......d..............@..@.data...L ..........................@....qtmetadv....@......................@..P.rsrc...@....P......................@..@.reloc...#...`...$..................@..B........................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\dsengine.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):249328
                                        Entropy (8bit):6.60433177058215
                                        Encrypted:false
                                        SSDEEP:6144:cvrmV0Yz9nN8vIy/9fFhVGpz4FX+kmABj//TNmudDorfpng++hO:cTQ0YQwy/9fFhVGpz4hGmO
                                        MD5:9B50FCC0A5B05E57E5FA79E90AE40614
                                        SHA1:1309F865492AC2307B09F5638290B9D1BDF36C03
                                        SHA-256:26E1916B58D688E28B5746B2D81C10A4A09C8FC13E78DB62BB590D8CD648FBA9
                                        SHA-512:813A9BE26BE0DAFBBC30910D89F335505596177FE31F5885B99093BC7DC6267DEF482C077A13298AC3467476A75B773BF54F0B3A8E10503F8AB9614B01CF935C
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......9a..}.f.}.f.}.f.tx..u.f..oc.n.f..ob.w.f..oe.x.f..og.y.f..pg.w.f.ikb.{.f.ikc.|.f.ikg.j.f.}.g...f..pc.?.f..pf.|.f..p..|.f..pd.|.f.Rich}.f.........................PE..L......_...........!.....V...\.......\.......p......................................E.....@.........................P...x...............H........................5..t...T...............................@............p...............................text...TU.......V.................. ..`.rdata.......p.......Z..............@..@.data....%...p..."...T..............@....qtmetad.............v..............@..P.rsrc...H............x..............@..@.reloc...5.......6...|..............@..B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):55280
                                        Entropy (8bit):6.443475230181386
                                        Encrypted:false
                                        SSDEEP:768:OKP3SZO/dRMNQfEqLL0tc1wl6yEPSFSQEii7t0JSuK5VFVd9hkTBaY4/4qm8Ci3n:uO/oNQsptc1+6WmCBa/4qmHejEUfT
                                        MD5:54F6DC69CD4C4B1C7AEF4305AA10C9C1
                                        SHA1:A90EB329D9B359DBD561F0F57BB512AD29EF333C
                                        SHA-256:E1207397F01FBA55A45224F1F451C2F0D946E3D2B7DF30BF67E81BF91FE8A114
                                        SHA-512:1CC1F6D623519E06DF5FE943B04DC0CB99EFB42CDBB5C5F91DF79FF8DC9B086419E6474E71A835FB180F9994C728C6DC0289DB724704A2ABBB1C2DC857263020
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}..}..}.....}.V.|..}..|..}.V.x..}.V.y..}.V.~..}...|..}..|.`.}...x..}...}..}.....}......}.Rich..}.................PE..L......_...........!.....R...j.......X.......p............................................@................................. ...........X.......................4.......T................... .......h...@............p...............................text...4Q.......R.................. ..`.rdata..PL...p...N...V..............@..@.data...............................@....qtmetad............................@..P.rsrc...X...........................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\mediaservice\wmfengine.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):173552
                                        Entropy (8bit):6.564920633762343
                                        Encrypted:false
                                        SSDEEP:3072:hz8GUoKQkSqmFyCxkFZQCn3ePX1ggRkf943m6WjD/ISrN1dK1WgCOcf7Ka8G:hz8QkSqmFyCxM3q1ggRkf943m6WjD/Io
                                        MD5:6346691E82EB3A5D8BEC7F39440A0581
                                        SHA1:D53DDE9FEF595C0707BD394ECA1A4539FD3C1B72
                                        SHA-256:3EB8D4CC2E2C9DC3C3703CAAEC8EFA9982D4B9C325541FB1642777110A9FB265
                                        SHA-512:18044C918E284327E7CD7B3F94E51022E811B028810CC3457690E02A68B7307EAA8D96179863B64EC357D2651B718AF6660548BF488EED605D169BE90C4407BD
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........H....................x.......x.......x.......x...............5..........................................S...5......5......5.m.....5......Rich............................PE..L...z.._...........!.................................................................N....@.........................`...x...............H........................#..|...T...............................@............................................text............................... ..`.rdata..Z...........................@..@.data........`.......F..............@....qtmetad.............`..............@..P.rsrc...H............b..............@..@.reloc...#.......$...f..............@..B................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qminimal.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):701936
                                        Entropy (8bit):6.797990435428196
                                        Encrypted:false
                                        SSDEEP:12288:49mqUd6YYwP+SbYFBsBHd5TsB0d3zV21lnjbduklgo123zDfEWmd9:49m4Y1+OYABHDsB0x41lnXIeZP
                                        MD5:2AFD07C16A47B2CDE639D777CA7224EB
                                        SHA1:9A08D20B993C9FB2D070D69CA8E7642DAC96DF19
                                        SHA-256:81E59D22D5EFDC2DE84C75386BF136C9E4417EB9164DECAFB4198D28F29DBA8A
                                        SHA-512:B69FACB50C0F8AC0C6E994BE16509190E57100905D6689B19F0CEBA2DCF13A9AE4EC17B2302B9214C32A25D2896AAFBEB8E9B4272E1A421B4020963AFBF87051
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./*..kKs.kKs.kKs.b3...Ks..$r.iKs..$v.~Ks..$w.aKs..$p.lKs.. w.jKs..;r.oKs.. r.bKs.kKr..Is..;w.LKs..;v.`Ks..;s.jKs..;..jKs..;q.jKs.RichkKs.................PE..L...7._...........!.....................................................................@.........................0...x.......@.......H.......................@<..H...T...................X...........@...............|............................text............................... ..`.rdata...O.......P..................@..@.data...D....`.......J..............@....qtmetad.....p.......V..............@..P.rsrc...H............X..............@..@.reloc..@<.......>...\..............@..B........................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):629232
                                        Entropy (8bit):6.802486576904191
                                        Encrypted:false
                                        SSDEEP:12288:FU09s7Ydf07Kw7AzQXSCjsBn8fztOnULj6TOZs8AADIDfEWmmPJ:Fs7q0+wIQXHsBnS4nULu6PZg
                                        MD5:E32BF024E3527CBEFCD95E5DB93BB8FC
                                        SHA1:705AC738B7AD7281F31A8197053515A87D7A5099
                                        SHA-256:E8A180285147394733DB92A532025A36824EA9416B993DFDCAA8E19A66B8B1B6
                                        SHA-512:032D5069C9E0819465C3F566D8555ABF6FE569B4B8B22E67083469F69EEF5AA03ACB99E0B42C90280AA36396AB6152A4D00A985AF5FD4C92D2428EA8ED2E7001
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u...............lv....."{.............."{......"{......"{......od..........$...od......od......od......od......od......Rich............PE..L...;._...........!.........b...............0............................................@.........................`...x...............H............~...........+..h...T...................x...........@............0...............................text...`........................... ..`.rdata..v%...0...&... ..............@..@.data........`.......F..............@....qtmetad.....p.......L..............@..P.rsrc...H............N..............@..@.reloc...+.......,...R..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwebgl.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):407024
                                        Entropy (8bit):6.511569293536778
                                        Encrypted:false
                                        SSDEEP:6144:/Tq4StevYAunBi2Sq2DXfz3ARHh2nyPIqGfrTacq1iOCJ:/Tq4GewBrSdfODIbJ
                                        MD5:C5A4F23C2F1CB00FAC420EF89AEEBB47
                                        SHA1:2F1E73E076683C1F87081BB8EA97F007714FE8D9
                                        SHA-256:30DFC5F5614427CDA0B4C97F25C2D6D19702562EC33E49C020768288CA1BEA7A
                                        SHA-512:B67ACC32BE891CCAA2615B575D2A7B213917F3F6E78FAC28D03B76F3EB48D04AABC96AB77190ECA31FB3BCE965E53657E2D37B2B71C379B4E96D1BBFB1E3C019
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E(.T.I...I...I...1`..I...&...I...&...I...&...I..."...I...&...I...9...I..."...I...I..VJ...9...I...9...I...9...I...9...I..Rich.I..................PE..L......_...........!.........v...............................................p............@......................... \..t....\..T.......@........................a...G..T....................H......`G..@............................................text.............................. ..`.rdata...B.......D..................@..@.data...\...........................@....qtmetadz...........................@..P.rsrc...@...........................@..@.reloc...a.......b..................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platforms\qwindows.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1219568
                                        Entropy (8bit):6.8048735134931535
                                        Encrypted:false
                                        SSDEEP:24576:JDpg2QmODTJROAxb4KHA2N8L+0C+6eCKMY3EEsBIzdCGvpzdZRE:UhwJN2NSC/glTE
                                        MD5:B2AF81698F607061986109B4A9004819
                                        SHA1:36A789F49738DE6A10BFE82A282EE7E5FEFD396B
                                        SHA-256:4D1EAF41136AC3FAEFB76F5CF2EFE8E7F8A11FD6A943A8B11F2F2A8BE5CFE19B
                                        SHA-512:1786885032C3A7F4B4D6624DC0F1365322619F6ED92417A8671FE0A36E20016E677F254DA0909395A5B4D0F4C3403072EED8C1471DC3B729CB2D687C4F78B6C4
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......q..d5..75..75..7<.y7!..7...6 ..7...6?..7...6=..7...61..7!..66..7!..64..7...61..7...6...7!..6 ..75..7...7...6|..7...64..7...74..7...64..7Rich5..7................PE..L...q._...........!.....L...R....../K.......`......................................f.....@.........................._..x...._..........H.................... ..\...t!..T....................".......!..@............`..l............................text....J.......L.................. ..`.rdata..\6...`...8...P..............@..@.data....V.......6..................@....qtmetad............................@..P.rsrc...H...........................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):54256
                                        Entropy (8bit):6.539788327915835
                                        Encrypted:false
                                        SSDEEP:1536:gZvYcLKYdZndpaOAmO0lu1GQ3xMesk255EUf7:YdLKYdZnWONO0luGQ3xMef255r
                                        MD5:1F0503A2A3CB332AA59CAEE30F87F91A
                                        SHA1:7865CA0B1EE0C2BAF06D354493128D9DC75EFB99
                                        SHA-256:721EC33B6907DF5621C0A1F06D35DAE91372CCF71392046DFB926DE11CB577AA
                                        SHA-512:17C8596B75323DF4684A347902AA54C9E5F12C602F9B6701A80426B4F8339F123B1136239BAD5549DFD17475148F78CE7CCE5058C2CEBF9BBBA9B00677963325
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V...................1.............1.......1.......1.......|...............|.......|.......|.a.....|.......Rich............................PE..L...?._...........!.....\...\.......c.......p............................................@......................... ...................X............................z..T....................{.......{..@............p...............................text....[.......\.................. ..`.rdata...B...p...D...`..............@..@.data...............................@....qtmetad............................@..P.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29680
                                        Entropy (8bit):6.296558865998482
                                        Encrypted:false
                                        SSDEEP:384:TWOC4NFPb0hOBHXjPL3VQ7i17hAXuXWwsP28ondDGWDgf2hyp:aKHB7LK74hXWwsP28mdDGWUf2hM
                                        MD5:EF5291D51807167542BAC67168D712FA
                                        SHA1:58ABBBD638AFC71479B846998F601ED2FA912A78
                                        SHA-256:DE588A423926B9943737E16799048A97160DFA83E4D46FF9B2278FEA1DF11D9E
                                        SHA-512:8A7AA886FB9257D7A245890852C3D0CF6DC5360F57F8BA1E4269B28807594CF040D192B8B0B2616B8400C6276BF117BBA634F522E179CF0D4511054DADAA7DC1
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]...]...].......].e.\...]...\...].e.X...].e.Y...].e.^...].(.\...]...\.&.].(.X...].(.]...].(....].(._...].Rich..].................PE..L......_...........!.........8......P%.......0...........................................@.........................@?.......?..........X............X...............4..T....................5......05..@............0..(............................text............................... ..`.rdata..\$...0...&..."..............@..@.data........`.......H..............@....qtmetadZ....p.......L..............@..P.rsrc...X............N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):45040
                                        Entropy (8bit):6.551151700286116
                                        Encrypted:false
                                        SSDEEP:768:xXhkTJrc5LMOqZidKxpsi5IW3y7GRepuACpdDGpzUf2hmAj:xXhkTecOKxpn5B3y7GRepuACpUzUf2j
                                        MD5:33861624E98D79EF87E1F936785E6F55
                                        SHA1:774AB45BF39289F9723363AE8819A771C67B69DF
                                        SHA-256:DC4F1C80081059AA1EC426A2D66AFD5163B04F7A3AC0AE275BF650D66894B492
                                        SHA-512:9C56AE87D2702804F4DCC8C5CAC83860F8A2F5E8C59059AB29D176E08D56B801C7E9775FC02A7C27EE14CCFC31FF64F3F50E8D2B74823EC7B48077274E56BC87
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3U'.R;t.R;t.R;t.*.t.R;tE=:u.R;tE=>u.R;tE=?u.R;tE=8u.R;t.":u.R;t.9:u.R;t.R:t(R;t.">u.R;t.";u.R;t.".t.R;t."9u.R;tRich.R;t........................PE..L...4._...........!.....L...F.......Q.......`......................................yW....@..........................r......4s..........`............................h..T....................i.......i..@............`...............................text....J.......L.................. ..`.rdata...1...`...2...P..............@..@.data...............................@....qtmetad............................@..P.rsrc...`...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):133104
                                        Entropy (8bit):6.518625487357124
                                        Encrypted:false
                                        SSDEEP:3072:Ef08LJXP50EuapXuJWd62ymc7xliHCTBIm2/40mwr6D5RXffv3xf6D:ufFRQLTBImI40mwr6D5RXffv3p6D
                                        MD5:53AF56EA898BB82775FDD0F940C429D2
                                        SHA1:5675FD1243EA87E59256B05E5A7C6C64298312EA
                                        SHA-256:547606FC8A6B20A2616A4F390C6CF0E7AA713F6AD53BAE23C8D1B021885AAB0E
                                        SHA-512:401F9B346A3DA18E750CF26CC05E1013EC8446955344D0E353012ABDCB4AF4E836515531B1BEF4C2FA5A07EC5B41A9CD74C68E39B977E43F9AD1A06AC32FA27E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_})E>.zE>.zE>.zLF.zC>.z.Q.{G>.z.Q.{O>.z.Q.{F>.z.Q.{R>.zQU.{M>.z.N.{B>.zE>.z.?.z.N.{C>.z.N.{D>.z.N.zD>.z.N.{D>.zRichE>.z........PE..L...H._...........!.....N........../S.......`...............................0......4.....@......................... ...................X.......................8....r..T....................s.......r..@............`..`............................text....L.......N.................. ..`.rdata...r...`...t...R..............@..@.data...............................@....qtmetadm...........................@..P.rsrc...X...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_ar.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):160017
                                        Entropy (8bit):5.35627970915292
                                        Encrypted:false
                                        SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                        MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                        SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                        SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                        SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                        Malicious:false
                                        Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_bg.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):165337
                                        Entropy (8bit):5.332219158085151
                                        Encrypted:false
                                        SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                        MD5:660413AD666A6B31A1ACF8F216781D6E
                                        SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                        SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                        SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                        Malicious:false
                                        Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_ca.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):210159
                                        Entropy (8bit):4.666388181115542
                                        Encrypted:false
                                        SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                        MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                        SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                        SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                        SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                        Malicious:false
                                        Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_cs.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):174701
                                        Entropy (8bit):4.87192387061682
                                        Encrypted:false
                                        SSDEEP:3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
                                        MD5:C57D0DE9D8458A5BEB2114E47B0FDE47
                                        SHA1:3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
                                        SHA-256:03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
                                        SHA-512:F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
                                        Malicious:false
                                        Preview:<.d....!..`.......cs_CZB..3p...*..F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9...............*...;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_da.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):181387
                                        Entropy (8bit):4.755193800761075
                                        Encrypted:false
                                        SSDEEP:3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
                                        MD5:859CE522A233AF31ED8D32822DA7755B
                                        SHA1:70B19B2A6914DA7D629F577F8987553713CD5D3F
                                        SHA-256:7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
                                        SHA-512:F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
                                        Malicious:false
                                        Preview:<.d....!..`.......daB..4....*..h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V...*...f...e...f.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_de.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):220467
                                        Entropy (8bit):4.626295310482312
                                        Encrypted:false
                                        SSDEEP:3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
                                        MD5:40760A3456C9C8ABE6EA90336AF5DA01
                                        SHA1:B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
                                        SHA-256:553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
                                        SHA-512:068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
                                        Malicious:false
                                        Preview:<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_en.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16
                                        Entropy (8bit):4.0
                                        Encrypted:false
                                        SSDEEP:3:j2wZC4n:CwZ
                                        MD5:BCEBCF42735C6849BDECBB77451021DD
                                        SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                        SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                        SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                        Malicious:false
                                        Preview:<.d....!..`...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_es.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):165170
                                        Entropy (8bit):4.679910767547088
                                        Encrypted:false
                                        SSDEEP:1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
                                        MD5:C7C58A6D683797BFDD3EF676A37E2A40
                                        SHA1:809E580CDBF2FFDA10C77F8BE9BAC081978C102B
                                        SHA-256:4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
                                        SHA-512:C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
                                        Malicious:false
                                        Preview:<.d....!..`.......es_ESB../....*..*,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_fi.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):179941
                                        Entropy (8bit):4.720938209922096
                                        Encrypted:false
                                        SSDEEP:3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
                                        MD5:8472CF0BF6C659177AD45AA9E3A3247C
                                        SHA1:7B5313CDA126BB7863001499FB66FB1B56C255FC
                                        SHA-256:E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
                                        SHA-512:DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
                                        Malicious:false
                                        Preview:<.d....!..`.......fiB..38...*..ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]..*....s...T...t.......................;..*....;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5...*...5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_fr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):166167
                                        Entropy (8bit):4.685212271435657
                                        Encrypted:false
                                        SSDEEP:1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
                                        MD5:1F41FF5D3A781908A481C07B35998729
                                        SHA1:ECF3B3156FFE14569ECDF805CF3BE12F29681261
                                        SHA-256:EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
                                        SHA-512:A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
                                        Malicious:false
                                        Preview:<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_gd.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):189580
                                        Entropy (8bit):4.630160941635514
                                        Encrypted:false
                                        SSDEEP:1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
                                        MD5:EB1FB93B0BE51C2AD78FC7BA2F8B9F42
                                        SHA1:24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
                                        SHA-256:63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
                                        SHA-512:E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
                                        Malicious:false
                                        Preview:<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8|..f...Z...f...=..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_he.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):138690
                                        Entropy (8bit):5.515748942553918
                                        Encrypted:false
                                        SSDEEP:3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
                                        MD5:DEAF87D45EE87794AB2DC821F250A87A
                                        SHA1:DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
                                        SHA-256:E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
                                        SHA-512:276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
                                        Malicious:false
                                        Preview:<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_hu.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):160494
                                        Entropy (8bit):4.831791320613137
                                        Encrypted:false
                                        SSDEEP:3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
                                        MD5:E9D302A698B9272BDA41D6DE1D8313FB
                                        SHA1:BBF35C04177CF290B43F7D2533BE44A15D929D02
                                        SHA-256:C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
                                        SHA-512:12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
                                        Malicious:false
                                        Preview:<.d....!..`.......hu_HUB../....*.......+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T...*...U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\....*..]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V....*.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_it.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):161172
                                        Entropy (8bit):4.680034416311688
                                        Encrypted:false
                                        SSDEEP:1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
                                        MD5:88D040696DE3D068F91E0BF000A9EC3E
                                        SHA1:F978B265E50D14FDDE9693EC96E99B636997B74D
                                        SHA-256:7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
                                        SHA-512:F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
                                        Malicious:false
                                        Preview:<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_ja.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):129911
                                        Entropy (8bit):5.802855391832282
                                        Encrypted:false
                                        SSDEEP:1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
                                        MD5:608B80932119D86503CDDCB1CA7F98BA
                                        SHA1:7F440399ABA23120F40F6F4FCAE966D621A1CC67
                                        SHA-256:CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
                                        SHA-512:424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
                                        Malicious:false
                                        Preview:<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_ko.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):156799
                                        Entropy (8bit):5.859529082176036
                                        Encrypted:false
                                        SSDEEP:1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
                                        MD5:082E361CBAC2E3A0849F87B76EF6E121
                                        SHA1:F10E882762DCD2E60041BDD6CC57598FC3DF4343
                                        SHA-256:0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
                                        SHA-512:F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
                                        Malicious:false
                                        Preview:<.d....!..`.......koB..7....*.......+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^.............*...5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_lv.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):153608
                                        Entropy (8bit):4.843805801051326
                                        Encrypted:false
                                        SSDEEP:3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
                                        MD5:BD8BDC7BBDB7A80C56DCB61B1108961D
                                        SHA1:9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
                                        SHA-256:846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
                                        SHA-512:F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
                                        Malicious:false
                                        Preview:<.d....!..`.......lv_LVB.......*...B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x...*.._......._....{..yg......1...5v...E..7........(......B.......|.......|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_pl.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):162982
                                        Entropy (8bit):4.841899887077422
                                        Encrypted:false
                                        SSDEEP:1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
                                        MD5:F9475A909A0BAF4B6B7A1937D58293C3
                                        SHA1:76B97225A11DD1F77CAC6EF144812F91BD8734BD
                                        SHA-256:CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
                                        SHA-512:8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
                                        Malicious:false
                                        Preview:<.d....!..`.......pl_PLB..0....*.."....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]..*....s.......t...r.......o.......+...;..*....;..+....;..."...;... ...M..*....O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_ru.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):203767
                                        Entropy (8bit):5.362551648909705
                                        Encrypted:false
                                        SSDEEP:1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
                                        MD5:5096AD2743BF89A334FBA6A2964300D4
                                        SHA1:405F45361A537C7923C240D51B0FF1C46621C203
                                        SHA-256:3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
                                        SHA-512:7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
                                        Malicious:false
                                        Preview:<.d....!..`.......ru_RUB..7....*...L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H....*..IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_sk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):125763
                                        Entropy (8bit):4.80343609423322
                                        Encrypted:false
                                        SSDEEP:3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
                                        MD5:3D60E50DCBCBD70EE699BC9B1524FCB9
                                        SHA1:0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
                                        SHA-256:D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
                                        SHA-512:F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
                                        Malicious:false
                                        Preview:<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_tr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):194487
                                        Entropy (8bit):4.877239354585035
                                        Encrypted:false
                                        SSDEEP:3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
                                        MD5:6CBC5D8E1EABEC96C281065ECC51E35E
                                        SHA1:4E1E6BA3772428227CB033747006B4887E5D9AD1
                                        SHA-256:6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
                                        SHA-512:CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
                                        Malicious:false
                                        Preview:<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_uk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):158274
                                        Entropy (8bit):5.402056706327934
                                        Encrypted:false
                                        SSDEEP:1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
                                        MD5:D6234E4E21021102B021744D5FA22346
                                        SHA1:63A14327D0CF0941D6D6B58BFA7E8B10337F557B
                                        SHA-256:51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
                                        SHA-512:37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
                                        Malicious:false
                                        Preview:<.d....!..`.......uk_UAB../....*...E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H...*...I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..*y...s.......t...........;.......n...;..*Q...;..+U...;.......;...x...;..!(...M..*....O.......O...........6...}..*........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtbase_zh_TW.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):127849
                                        Entropy (8bit):5.83455389078597
                                        Encrypted:false
                                        SSDEEP:3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
                                        MD5:9C6A3721D01ECAF3F952CE96F46CE046
                                        SHA1:4A944E9E31DF778F7012D8E4A66497583BFD2118
                                        SHA-256:085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
                                        SHA-512:6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
                                        Malicious:false
                                        Preview:<.d....!..`.......zh_TWB..2x...*.......+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..*W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_ar.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):11486
                                        Entropy (8bit):5.268991075562103
                                        Encrypted:false
                                        SSDEEP:192:20UQRn2sg91xzuera9bIWo6P5qIJtzi82337ui:2ri2sgj6E6P5qizPWLui
                                        MD5:C0A0146E0F690E7CFFF468D9D2B23BF8
                                        SHA1:4649CDF3C53E6012810F44D8A8903EE7606F4B35
                                        SHA-256:5FC10414E168C1161B8590A5C173D140D31B17CF450F0AC93E666EBF7A2FF908
                                        SHA-512:6AA319C3CC6CEC5F6F06BDAE653F97E6B31D49DEB012DB84EE816DE5A6FFD0DD7A1395A8D387557081D87A6D54BE31EE8083A13B6BCB030CEAF4D7247701DC22
                                        Malicious:false
                                        Preview:<.d....!..`.......arB.....X.A..#.................Q.......R.....H.W.>.........%....1..#h.C|......OY....I.c....'k..]>...k..]>...M..................t..&F................|......W.......[C......p....%...#..."....n..........!..................zn......*......:.....@.C......w\^...X.............)...TD...g..T................N.....q3....z...........U.......T..............b........1..........."...............e.........c.....I.l.E.....l.E...C.l.E..)...6...'............a..$x. ^>.........!Y...... -......>............(>.#......K.s......s....t......'...n...A....&...Z..............X5A.....q.C.....x.....9...^...G...N......L.......M..."I......B.......P.w. .....};...._...... ........)..J....|.........?.............|....(...Q5..._..KT...ri..).....6.F.3.B. .E.D.A.Q.'.*. .R.A.W. .(.(.D.'. .*.1.H.J.3.).)..........RAW (headerless) file format.....AudioContainerControl.......F.3.B. .E.D.A.Q.'.*. .W.A.V..........WAV file format.....AudioContainerControl.....0.(.J.'.F.'.*. .P.C.M. .5.H.*.J.Q.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_bg.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13683
                                        Entropy (8bit):5.206041252254424
                                        Encrypted:false
                                        SSDEEP:384:rcVs16vrAWygoSWLyZ5aQVa3A3mMa83DB3eAsk:rcVs16vrAWyoWuZ5aQVa3A2Maq93eAsk
                                        MD5:15EA6B38E1EF62ABC6AE030ED6C665DB
                                        SHA1:4F541734690E100747A99D259D2DAB948BE0D68A
                                        SHA-256:ADD8675FBC2351FB6C8397ED36932F98553782DD4CE0498EFC5B89B050AC8626
                                        SHA-512:B34A1465E59F156F87879F83BA350AE7D632CE246C079BDE2976ED53B6DC6CDED1989CF6C80F53CA94498AD3EC8E573F0B60D21EEDAC742F81D0FF3C78634FF3
                                        Malicious:false
                                        Preview:<.d....!..`.......bgB.....X.A..+.......$.........Q.......R.......W.>...2.....-....1..+".C|....B.OY...%...]>...S..]>..!........j..........t...n.............-..|...%..W.... ..[C......p....-...#...*{...n..........)U.................zn...,..*......:....#..C....G.w\^.........%i......1y..TD......T....U...........N.....q3....<......&g...U...}...........T..............b........1...........R......$....... ........).c.......l.E.....l.E.....l.E..2...6.../\......#@...a..,^. ^>...o.....(.......'.......P............0p.#......K.s......s.........../...n............Z............@..\T.."..X5A.....q.C...j.x.........^.......N...c..L.......M...).................w. .....};....B......(........I..J..............?..........!..|....0...Q5......KT...|i..2s....@.$.0.9.;.>.2. .D.>.@.<.0.B. .R.A.W. .(.1.5.7. .7.0.3.;.0.2.:.0.)..........RAW (headerless) file format.....AudioContainerControl.....".$.0.9.;.>.2. .D.>.@.<.0.B. .W.A.V..........WAV file format.....AudioContainerControl.....2...C.4.8.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_ca.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):14877
                                        Entropy (8bit):4.495618627792468
                                        Encrypted:false
                                        SSDEEP:192:xWSMgD83O3Oesgu143Ik6f0w633EyAo3tb3Mb3y3CJ3Q3IF+P/F8NdEF3g033T3m:9M28+eesgY4npUyd9bsiSJP+Xu6Q03j2
                                        MD5:F4ACB5614C77260B4C1177CDB350942E
                                        SHA1:C53DA2DACF580A48D18E4BC36B513A6402147F4C
                                        SHA-256:99AAE58CE729312B4ED38DB7D8AA42C770EAA4CC3F669626F9BEB9676BC21EF2
                                        SHA-512:E736DD2B985F8E579598E9465C662E2D53427FC4ED05FFC1DD1580DBA485021581AD4D0700A58E971A48FF9D6455597BA486078DEDF72CEAB8B02E557FB9FA37
                                        Malicious:false
                                        Preview:<.d....!..`.......caB.....X.A../........7.Q.......Q.....2.R.....V.W.>.........1....1../..C|......OY...(..c....3...]>..!...]>..&y......................%...........t..2h.............,.......5..|...)..W....$..[C......p....1...#...._.......~...n...a..............-7.................zn......*.............:....'..C......w\^.. @.....)U......5...TD......T....Q......#J...N...g.q3............:......*]...U.."D...T..............b....[...1..................({......%U.........c.......l.E.....l.E...s.l.E..6...6...3l......'8..{4...}...a..0L. ^>.........,.......+.......`............4..#......K.s...I..s...".......47..n........2...Z..............=.......X5A.....q.C.....x.........^.......N......L....t..M...-...............Z.w. .. ..};...$.......+...........J.........../..?....g.....%..|....5`..Q5......KT...zi..6.....L.F.o.r.m.a.t. .d.e. .f.i.t.x.e.r. .R.A.W. .(.s.e.n.s.e. .c.a.p...a.l.e.r.a.)..........RAW (headerless) file format.....AudioContainerControl.....(.F.o.r.m.a.t. .d.e. .f.i

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_cs.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):15906
                                        Entropy (8bit):4.737087172418041
                                        Encrypted:false
                                        SSDEEP:384:RcPvbZYqjMvs1eEt86I3f4EwKiZU8UkFPU:RcPvbZYRvs1e76I3w+8UsPU
                                        MD5:3BBF388844D5DB68FBE5EF1ABF01031A
                                        SHA1:257CC6C095C67000D4DE8F832F3447E0F755905D
                                        SHA-256:6F116E7A2FDEFE84A890DF1718D235E61D5731BF7C2E3E57A838F6EC9EEDE0FA
                                        SHA-512:3F2328AADF5A8DFECE7DDED754CAA2C3FCC861564D135C6C1D0699AAA57A986E62B652EC41352EDC0353927A512F72844A124EAC3D8551AED794731B8B13C039
                                        Malicious:false
                                        Preview:<.d....!..`.......cs_CZB.....MJ....1.OY......X.A..6%................Q.....G.R.....s.W.>...i..D..........7...}q.......1..5..C|......OY...0Q..]>..(!..]>..-.......%.......T.Qz....m...t..8h............#...|...,@.W....+f.[C.......#...4...[E......'....t......:...n...L......3...........0$...Q..zn......*...&-..*...').:..../2.C......w\^..&......0...TD..#G..T...".......)....N...X..K....*......1....U..)!......(............T.."G....... ...1.......1.. ..6..................../.......+...........V......W......c.......l.E...,.l.E.....l.E..!...Z2.......~.......~......6...9E..........&A.......a..6....S...o. ^>...*.I}b.........3.......1.................... j..'.............#......K.s......s...)....N..........9...n........8..N........Z...............\T...-.X5A.....q.C.....x.........~...p...N......L.......M...4 .....$J.......5.w. ..'..};...*...o....h......2w..........J...._..J....J.......?.....$...?..........,...Q5..%...KT..!k..G.....i..:[....(.S.o.u.b.o.r.o.v... .f.o.r.m...t. .R.A.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_da.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13659
                                        Entropy (8bit):4.616849544167846
                                        Encrypted:false
                                        SSDEEP:192:Xr0R2Psma1C9gNjFjOMFyp/vSR5p2h8klZBrNQ:XAR2PsmEFewyp/aR2ieZBe
                                        MD5:34BB0ECE3C0DB02ED3E1E73AE1932719
                                        SHA1:E23C7790CAFBA427A3E70F705B7B4CBE9F228DDF
                                        SHA-256:39D902411064CC5C5FD45742F1768022A1AE7953700741B2F608E3807E19110A
                                        SHA-512:9E1C462D2535D7262127AF3DF8028E27F57C3352E97EB28F6D4055516D453C9F60775283DD4A63EDD3ECB76C557F94F82988545B5016B764EE1DB8CA13AA87F0
                                        Malicious:false
                                        Preview:<.d....!..`.......daB... .X.A..+.......`.........Q.......Q.....p.R.......W.>.........- ...1..+L.C|......OY...%..c..../...]>...A..]>..#........t..........................t...\.....................'..|...&p.W...."..[C......p....-...#...*............n...I..............).......*..........zn...X..*...........T.:....$..C......w\^.........&.......1?..TD......T...._...... ....N...M.q3....l.......:......'....U.......T..............b........1...........<......%E......"..........c.....i.l.E.....l.E.....l.E..1...6.../,......$0..{4...W...a..,p. ^>.........).......'.......*............0V.#......K.s...#..s... `....../...n............Z..............=.....<.X5A.....q.C.....x.....{...^...{...N...'..L.......M...*...............<.w. .....};...!y......(|..........J....x.........?.........."..|....0...Q5......KT....i..2.....2.R...t. .(.h.o.v.e.d.l...s.t.). .f.i.l.f.o.r.m.a.t..........RAW (headerless) file format.....AudioContainerControl.......W.A.V.-.f.i.l.f.o.r.m.a.t..........WAV fi

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_de.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):15006
                                        Entropy (8bit):4.524251350180448
                                        Encrypted:false
                                        SSDEEP:192:szJCssbW1tE1I2oaaVCDKEeNByOApdLowK18C3B/:sz0ssbQt3IQBNSfK+gB/
                                        MD5:2EA100003233A563C03EC7B0A0C0D2ED
                                        SHA1:EF56DB962FC5217A0DAB92BCC6CABB1CBE825A00
                                        SHA-256:7D1541468BD09F4A34E78595DAEBDCFD7BF71715C34BF95C2DCCE41BF5484155
                                        SHA-512:799271B682DAC7C9DB10B8EB3BE5237355199A30013E08C92024C68A01806710971B0A812CBFDF023F21FD2A5298F1E3F4BFF9850D5D7E357BC12CA1F7164462
                                        Malicious:false
                                        Preview:<.d....!..`.......de_DEB.....X.A..0........7.Q.......Q.......R.......W.>...B.....1....1../..C|......OY...)..c....4...]>.."S..]>..').......Z..............Y.......i...t..3V........................|...*h.W....%..[C......p....2...#.../3.......L...n..................-...............E..zn...r..*... .........:....(r.C......w\^.. ......*.......6...TD......T....;......$....N...M.q3............@......+#...U..#"...T..............b........1...........L......))......%..........c.......l.E.....l.E...y.l.E..7...6...4<......'...{4.......a..1.. ^>.........-I......+.......B............5..#....g.K.s...g..s...#.......5...n...+....3...Z....+.........=.......X5A.....q.C.....x.....C...^.......N......L.......M...................T.w. ..!..};...$.......,...........J..............?..........&U.|....5...Q5......KT...di..7[....:.R.A.W.-.D.a.t.e.i.f.o.r.m.a.t. .(.o.h.n.e. .H.e.a.d.e.r.)..........RAW (headerless) file format.....AudioContainerControl.......W.A.V.-.D.a.t.e.i.f.o.r.m.a.t.........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_en.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16
                                        Entropy (8bit):4.0
                                        Encrypted:false
                                        SSDEEP:3:j2wZC4n:CwZ
                                        MD5:BCEBCF42735C6849BDECBB77451021DD
                                        SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                        SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                        SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                        Malicious:false
                                        Preview:<.d....!..`...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_es.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):17046
                                        Entropy (8bit):4.488067064247524
                                        Encrypted:false
                                        SSDEEP:192:qTAb/kqIRnp2Psn41kjT22m8T+dEw0Zpe4Q6fn87wZ9OdDq3D:MAb/kqIFUPsnKWhwcpeuf89da
                                        MD5:F2E05CF385B73830C66997878BBE96C1
                                        SHA1:1E5D672AB83BFB84ADE3C808F9A792F74FD1394B
                                        SHA-256:0866911BFD4C6E78D3517EA298DE653CAEF0B7248AEFACDBA5236E7565A9B2A5
                                        SHA-512:4C84CED507C284D7D50107F4086F30267F9057880F34320F54289F4E37761A4B7ABFA12A0BD6AD64E13ED0A7640E0B97555BE9B1D7B44B3C606CB0F581BBCA5A
                                        Malicious:false
                                        Preview:<.d....!..`.......es_ESB.....MJ....).OY......X.A..8@..............G.Q.......R.......W.>......D..........9...}q.......1..7..C|......OY...1...]>..)...]>...4......&.......Z.Qz....;...t..:.............$...|...2D.W....,..[C....).p....:5..#...7...[E..........P...n...C......5......"........u..0$......zn......*...'M.:....02.C......w\^..'......1.......=...TD..$Y..T...#.......+....N...g..K......q3... .......2....U..*!......)............T..#m.......H..b........1...!...1..!{.6....................0.......-...........V......W....Z.c.....w.l.E...F.l.E.....l.E..#..l.E..>....~.......~......6...;......./....a..8....S..... ^>.........5/......3.......w............ f.....<.........#......K.s...[..s...*....N..........<A..n..._....;/..Z....W..........\T.....X5A.....q.C.....x.........~...d...^...%...N......L....:..M...6c.....%H.......j.w. ..({.};...+...o....~......4...........J............W.....%...?....).....-~.|....=b..Q5..&...KT..".i..>.....J.f.o.r.m.a.t.o. .d.e. .a.r.c.h.i.v.o. .

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_fi.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13883
                                        Entropy (8bit):4.587256778643159
                                        Encrypted:false
                                        SSDEEP:192:5xqudvG/srvG1YOIDcz0dIwMrOH5exEeTD5+oDwYKtToV8qxh+upeSIraT0wYnf6:/qudvG/srvAYO04xtTlrzKWeGgD6
                                        MD5:F9B40CF075E511A54ACF25CD301B2A05
                                        SHA1:C84D587DAC38A7E1747E420854978D1FC27A925E
                                        SHA-256:628BE72C1DC70652AB302E2F8CCB9F3C328E7FDDDF7D8D1C5CE21056A9BA84F2
                                        SHA-512:6D6C968D5A0F7FA46867A182261509C145522F8EC059AA4C42F28C4B38EF40A32CF2913F03BC800845B14BBE76AC6ED7F96E97C7BC4122C2B6D293D1E102D2BD
                                        Malicious:false
                                        Preview:<.d....!..`.......fiB... .X.A..,.......f.........Q.......Q.....V.R.....^.W.>...F.....-....1..,..C|......OY...&..c....0?..]>.. ...]>..$m.......L..............u...........t............................|...'n.W...."..[C......p.....W..#...+w...........n...W..............*m.................zn......*....o......t.:....%..C......w\^.........'.......2...TD......T....;......!....N...O.q3....t..............(....U.. ....T..............b........1...........6......&E......#_.........c.......l.E.....l.E.....l.E..2...6.../.......%(..{4.......a..-.. ^>...'.....).......(.......L............1..#......K.s......s...!>......0...n......../M..Z..............=.....t.X5A.....q.C.....x.........^...{...N...+..L....|..M...*...............,.w. ...U.};..."?......)t..........J..............?....w.....#..|....1...Q5......KT....i..2.....>.R.A.W.-.t.i.e.d.o.s.t.o.m.u.o.t.o. .(.t.u.n.n.u.k.s.e.t.o.n.)..........RAW (headerless) file format.....AudioContainerControl.....".W.A.V.-.t.i.e.d.o.s.t.o.m.u.o

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_fr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16502
                                        Entropy (8bit):4.523787100967048
                                        Encrypted:false
                                        SSDEEP:192:0zjDNrhYqqg7mPOnkq4wKAAEF8XDj7Ps7I1HzGetICvxbTV60PZtR2TeZm6Pynsm:07Nrhp3kCvsPs7am0bRPpEOOzB
                                        MD5:DF28B5BCDEDC3FDEAD3749E6A0861F81
                                        SHA1:7F64D46BD5D6BF7254242CF0DBDE179954123719
                                        SHA-256:622FB2AB66D224C946BBBE8B4B06CCB45EA4B1368BA0E822A07BAD4B7C4BBD36
                                        SHA-512:97D9053A6A236CA72D042597B4A150D703082810C1DE3542491938C93BFA871D2998A34C53F597913C80D5D02E0D7EF0E0CEB8D0609BB71B478E7E25A3317163
                                        Malicious:false
                                        Preview:<.d....!..`.......fr_FRB.....MJ....1.OY....'.X.A..6...............w.Q.....h.R.......W.>...0..D..........8...}q.......1..6T.C|......OY...0S..]>..(a..]>..-P......%d........Qz....E...t..:.............$...|...1..W....+..[C....c.p....8...#...5...[E...\..........n..........4...........0$......zn......*...&..:..../..C....#.w\^..'......0.......<'..TD..#...T...##......*S...N......K...........1....U..)e......)............T.."...........b........1.......1..!..6............. ....../.......,:.......'..V......W....\.c.......l.E...t.l.E...F.l.E.."U...~.......~......6...9............a..7|...S..... ^>...Q.....3.......2q......1............ ......;"........#......K.s......s...)....N...<......:>..n........9n..Z...............\T..-..X5A.....q.C...R.x.........~...b...^.......N.../..L.......M...5......$..........w. ..'..};...*...o...........3R.......-..J............W.....$...?..........,..|....;...Q5..%...KT..!.i..<.....H.F.o.r.m.a.t. .d.e. .f.i.c.h.i.e.r. .R.A.W. .(.s.a.n.s. .e.n.-.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_hu.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):16463
                                        Entropy (8bit):4.657374409195896
                                        Encrypted:false
                                        SSDEEP:384:RtGHxItMx2ssKAo0MZZPPXlDtAxb+tceVYwG9s4VbnzKMy9J:RtGHxItMx2ssKAo0MZZPPXlhkb+tceV3
                                        MD5:286A43C2C0699E792A63123EE3D11D89
                                        SHA1:2611BA80FBEF67CBE0C61CA981D5B37FD2841AEC
                                        SHA-256:589D857B96CB1C8E6DCB018C8CDAF71BF06D31AA1271867F8572183C9394F8D7
                                        SHA-512:92A7865CD3FF0CF2277100368193ABBF5557B4CF4323EF60DB998B1DA2317B9663E5199ADD6F6CA2F873942B5BAA40588253DE7F1335F0526380A00C63F4DA5F
                                        Malicious:false
                                        Preview:<.d....!..`.......hu_HUB.....MJ......OY......X.A..6D......Z.........Q.......R.......W.>......D....G.....7...}q...<...1..5..C|....N.OY.../...]>..'...]>..,.......$.......p.Qz........t..9.............#I..|...0f.W....+..[C....K.p....8W..#...4...[E..........p...n..........3......!@.......U..0$...Q..zn......*...%..:.....v.C....u.w\^..&>.....0.......;...TD.."...T..."u......)....N......K....J.q3...........1....U..(.......(V.......y...T..!........b..b........1.......1.. /.6..................../3......+........Y..V......W......c.....k.l.E...x.l.E...,.l.E..!..l.E..<K...~.......~......6...9............a..6....S..._. ^>.........39......1.....................*.....:.........#....?.K.s......s...)3...N...L......:K..n...5....9_..Z....1.......P..\T..-..X5A.....q.C.....x.........~...L...^...1...N......L.......M...4I.....#..........w. ..&..};...*V..o...........2........e..J............#.....$)..?..........+..|....;P..Q5..%...KT.. .i..<.....B.R.A.W. .(.f.e.j.l...c. .n...l.k...l.i.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_it.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):17194
                                        Entropy (8bit):4.475777186094896
                                        Encrypted:false
                                        SSDEEP:192:UC3TmO4QKfnqfbFgmLf6i5zmQjEPsT2i31ZG+f4YdzPXegWZQ3lQPmNEx4EzO31c:Uyrx0CaPsqkhjEeDUSBNs3h
                                        MD5:74E75500E4026F2DB8FF298B548E928A
                                        SHA1:085B10C64A4CF22444174805BCB6BA0AB5CCFC57
                                        SHA-256:ACA8D4DD145E671D827E582496F20281DC559AC91E7E13F88CF508BC2D6301ED
                                        SHA-512:6C20E99834D3033FC85FF23A9EFDD3D2DB4A40CDF24D69C04CA2470EEC4FF38469CDBE89DD62C4C620E9E3456D123F205A8A958E4FC717018BA832E9764BB2EF
                                        Malicious:false
                                        Preview:<.d....!..`.......it_ITB.....MJ....'.OY....U.X.A..8...... ........).Q.......R.......W.>...@..D..........:X..}q.......1..8T.C|......OY...2Q..]>..*3..]>../^......'0........Qz....I...t..;.............%...|...3$.W....-..[C......p....;...#...7...[E...j..........n..........6......#...........0$......zn...T..*...(c.:....1..C......w\^..(......2.......>o..TD..%e..T...$.......,=...N......K......q3...!.......3....U..+I......*............T..$w..........b....#...1.......1.."s.6.............P......1........,..........V......W....R.c.......l.E.....l.E.....l.E..$#.l.E..?....~.......~......6...<v......0....a..9....S..... ^>.........5.......4.......E............!d.....=n........#....O.K.s...Y..s...+....N...Z......<...n........;...Z...............\T..0..X5A.....q.C.....x.....5...~...R...^.......N...y..L.......M...7......&V.......>.w. ..)..};...,...o...........5Z..........J............U.....&...?.............|....=...Q5..'...KT..#.i..?g....J.F.o.r.m.a.t.o. .f.i.l.e. .R.A.W. .(.s.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_ja.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):14337
                                        Entropy (8bit):5.741374393238018
                                        Encrypted:false
                                        SSDEEP:384:zn1pQ8PxuF2WQMeOSJASTswQZs7WWdiTA6V8x:c8PxuF2WQMeOSJASTxQZs7WbTAWs
                                        MD5:27259833BCDE1CA4438A41863C9345DA
                                        SHA1:ECD2404A31215E2D814125D3DBD5ADC7C6D45083
                                        SHA-256:F9A888586C42C22894CCB4180257C2DE70299FF5D540087BC334DA74A8DD5969
                                        SHA-512:EA82A4CEB38CD6B134AB37A6257D88D6019D25B82D6B6E855A4ABA19A2403D18CBE9AA463CFB857EE221CA787EF47080336D9A1459F23F3582E5BD726A4BF84F
                                        Malicious:false
                                        Preview:<.d....!..`.......jaB.....MJ.... .OY......X.A....................Q.....q.R.......W.>...q..D....h...../...}q.......1..-..C|......OY...)D.l........]>..#4..]>..'....... .........M.......Qz........t..1......{..........|...)..W....%..[C......d.....9.p....0r..#...-J..[E..............n.......1..........,F..........0$......zn......*...!..:....(W.C......w\^.."+.....).......3:..TD...h..T...........$....N......K...........*V...U..#.......#........v...T...........S..v....7..b........1... ...1.......1...}.6.....[.H.C..................(.......&1..........V....c.W....W.c.......l.E.....l.E.....l.E.....l.E...\.l.E..3....~.......~...........~..6...1.......'....a../....S..... ^>.....5.t.........+.......*..............F......=......%.....2}........#....h.K.s......s...$`...N...!......2...n......w...}....1f..................Z...............\T..'..X5A.....q.C...a.x.........~.......^.......N......L....%..M...,...... /.......S.w. .."..};...%C..o....w......+i.......L..J................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_ko.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):11006
                                        Entropy (8bit):5.779927341401355
                                        Encrypted:false
                                        SSDEEP:192:rtqk8es6911OXRidgBnSQyHu5SW18acLhn:ps69rOHnzSW+acLB
                                        MD5:0161C0622AE59F0331FDE6C2D901327B
                                        SHA1:BC497F30FA42A5F73D2B4917FC2C12496EAFEE78
                                        SHA-256:F512A5E985535D0309F737E6156F5959AE9B6405E65FF76ABAE5A139332F2C7A
                                        SHA-512:903135B6C0D329F92B3617725749C64D1B24A28673BE325C471221C36378B01752AB57FB308CC6A69CA8D832C9BA1B472579320A55F48C3958093BE215B67107
                                        Malicious:false
                                        Preview:<.d....!..`.......koB.....X.A.."l.......q.Q.......Q.......R.....".W.>.........#....1..!..C|......OY......c....%...]>...o..]>...........&..............+.......k...t..$.........................|....2.W.......[C....[.p....$...#...!g.......(...n...C.......*...... .......P.......k..zn......*....+........:.......C....9.w\^...z.............'...TD......T....U...........N.....q3........................U.......T..........."..b...._...1...................5.................c.....=.l.E...\.l.E.....l.E..'...6...%X.......X..{4...m...a..".. ^>...U..... ........-...................&T.#......K.s...;..s....R......%...n........$...Z............P.=.......X5A.....q.C.....x.........^.......N...g..L....z..M... .......t.........w. .....};....'..................J....f.........?...........Y.|....&...Q5......KT....i..'..... .R.A.W.(..T. ....). ...|. ..............RAW (headerless) file format.....AudioContainerControl.......W.A.V. ...|. ..............WAV file format.....AudioContainerContro

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_pl.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):12237
                                        Entropy (8bit):4.698903308278698
                                        Encrypted:false
                                        SSDEEP:192:ej9dNDgWPsRh14pT260/C5nwL8CCQhoTBsyX2+N8dfu3:e5fDgWPsRXGq6sC5wYCCQ3z+Gf8
                                        MD5:2F3EA58057D8F5EE06B505B41079C981
                                        SHA1:13D38D2B95CC473A5C5CD1D6A3BD9FF69B5351B3
                                        SHA-256:3C4CB711F6A59E5B19E4ADC0D0A6BE63C0BB55F15626AD640DB1BFD1D1363664
                                        SHA-512:B8D5BE73F0291B4A63603541A0174C9E59E9C3C7A5560471B28FEC08B65D1ADFFBE4D52516D3A611E4B81941199103A4367B7A936198F12F2AEDC4245C810A08
                                        Malicious:false
                                        Preview:<.d....!..`.......pl_PLB.....X.A..&I......6.........Q.......R.....6.W.>.........'....1..%..C|....J.OY......c....*0..]>...W..]>...........f..........t..(.................|... {.W.....Y.[C......p....(J..#...%.......#..................zn......*......C....c.w\^......... ......,...TD......T....7...........N.....q3....L......!....U.......T..............b........1...........H.......<...............[.c.......l.E.....l.E..._.l.E..,...6...)............a..&.. ^>.........#^......!.......T............+-.#....i.K.s......s...........*...n..._....)N.X5A.....q.C.....x.........^......L....X..M...$`................w. .....};..........."...........J..............?....]......=.|....+...Q5......KT...ti..,.....@.F.o.r.m.a.t. .p.l.i.k.u. .R.A.W. .(.b.r.a.k. .n.a.g.B...w.k.a.)..........RAW (headerless) file format.....AudioContainerControl..... .F.o.r.m.a.t. .p.l.i.k.u. .W.A.V..........WAV file format.....AudioContainerControl.....8.D.a.n.e. .d.z.w.i...k.o.w.e. .w. .p.o.s.t.a.c.i. .P.C.M

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_ru.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):14109
                                        Entropy (8bit):5.264248799271436
                                        Encrypted:false
                                        SSDEEP:192:QKqItPsF4e6V1gHrptgfwwstDEp6SdZ9ZAUfiYNFzF0XJyo9Ea56V8C7Q7+ESqbj:QKZPsKZgt8dwYWXfEatierSqzb
                                        MD5:1841A70C30F9A2F3AA3F5BAEFF9208EE
                                        SHA1:3C9594CF1F3E2E64A74C32094F3B9A032C7E7FB1
                                        SHA-256:32C1118415F25A378D356CF01652393C8F9063145BC8F8A93C4F992166FA9D4D
                                        SHA-512:1C6A6A2775109FA28717913E35370CDCA5BD60C229CFD5BD63066044964EB165D65634B32E5BC6BBC4D6CBFACDB9C35B5192295CFDB85A88A9FC0A6E71704CD2
                                        Malicious:false
                                        Preview:<.d....!..`.......ru_RUB.....X.A..-..........Q.......Q.......R.......W.>..........b...1..,|.C|....>.OY...&..c....1...]>......]>..$M......................#...........t../.........................|...'N.W...."..[C......p..../...#...+............n..................*...............{..zn......*...........@.:....%n.C......w\^...b.....&.......2...TD...;..T...........!P...N.....q3............<......'....U.. P...T...i..........b........1..._.......6......&.......#........g.c.......l.E.....l.E.....l.E..3w..6...0.......$...{4.......a..-.. ^>.........*.......(.......J......j.....1..#....O.K.s......s... .......1[..n...U....0...Z....C.......P.=.......X5A.....q.C.....x.........^...e...N......L....:..M...+=................w. .....};...!.......)p.......k..J...........s..?....5.....#..|....2`..Q5...A..KT....i..3.....@.$.>.@.<.0.B. .D.0.9.;.0. .R.A.W. .(.1.5.7. .7.0.3.>.;.>.2.:.0.)..........RAW (headerless) file format.....AudioContainerControl..... .$.>.@.<.0.B. .D.0.9.;.0. .W.A.V.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_sk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):9896
                                        Entropy (8bit):4.651417016192566
                                        Encrypted:false
                                        SSDEEP:192:ymzlPsi1CPNRUNEjHE4YdKNoKBrbd8vFPe:1Psc6gEjHE4YdaNBH2vFPe
                                        MD5:D9B73E1E553693BBE20729B972166E70
                                        SHA1:6FBE8ACAF2671791C9043508D4FC6D8E5B804C7B
                                        SHA-256:82F544F31FFB0CE80340F445AD2C8E2BA57969413EF9B5D10FE4322BB96A6851
                                        SHA-512:BA376AE10C71C9770D60B6E3D177F5FE26C7A496B53E4F50686B6B538B71CB7D397B01012C334C26C85B2A62B436E7600B4CE847AF7D93F1514101DD9EF6175C
                                        Malicious:false
                                        Preview:<.d....!..`.......sk_SKB...8.X.A.. q.].....N.....!....1.....OY.......]>...3..]>.....................+........t.."Z...A.......=......|....>..|......W........#....<..'............0..........*....5..*....=.:.......QM^.....w\^..........#.......'.......~...U...-.......i...............................Q.......0.........l.E...n..6...#?..........&A......b...D...a..!.. ^>......tQ.................. .........'....Z.#....h..s...........#...a...h.........nE........"..N.....$..Z....}..\T......y.......L....y..M..............w. .....};...............J....Y..?....y......4.nP9......Q5......G.....i..$A....".R.A.W. .f.o.r.m...t. .s...b.o.r.u..........RAW file format.....AudioCaptureSession.....".W.A.V. .f.o.r.m...t. .s...b.o.r.u..........WAV file format.....AudioCaptureSession.......P.C.M. .a.u.d.i.o. .d...t.a..........PCM audio data.....AudioEncoderControl.....0.K.a.m.e.r.a. .n.i.e. .j.e. .p.r.i.p.r.a.v.e.n............Camera not ready.....CameraBinImageCapture.......J.P.E.G. .o.b.r...z.o.k.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_tr.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):13295
                                        Entropy (8bit):4.762391970296969
                                        Encrypted:false
                                        SSDEEP:384:05P7BsqxeP7OZaiOkP+HxW6gt5wQha7JVjSprkcJmcM8:AP7BsqxK7OZ9ORHQdt5XhAJVjSprtJmY
                                        MD5:E7E3EA251F76ED3C680CE40CB2C62250
                                        SHA1:92625294D74741F479D28C2C3110DCF0C815DB2F
                                        SHA-256:1C79A82DCD0314EBEC350293FFFE9E2CD35CCC6BD63C449C178D42EF1DA375CF
                                        SHA-512:F7997F9424C65CC9F880D211919E06157073B9083BA54435BF7BAF2AD806104DEA4E985EB055998DFECD73D00613E42F1C62C799AA4BA505A0BDDF36C3AC8594
                                        Malicious:false
                                        Preview:<.d....!..`.......tr_TRB.....X.A..**.......C.Q.....f.Q.......R.....0.W.>...n.....+....1..)..C|......OY...$..c........]>......]>..!...................................t..,..............h..........|...$..W.... s.[C......p....,1..#...(............n...........|......'..................zn......*....%........:....#..C......w\^.........$g....../...TD...C..T............8...N.....q3....8..............%Y...U...X...T...c..........b........1...........B......#....... ..........c.......l.E.....l.E.....l.E..0g..6...-......."...{4.......a..*.. ^>.........'A......&.......F............/..#......K.s...Q..s............m..n...C....-7..Z....!.........=.......X5A.....q.C.....x.........^...g...N......L....|..M...(;......&.......r.w. ...#.};...........&........-..J....~.........?..........!I.|..../l..Q5...m..KT...@i..0.....8.R.A.W. .(.b.a._.l.1.k.s.1.z.). .d.o.s.y.a. .b.i...i.m.i..........RAW (headerless) file format.....AudioContainerControl..... .W.A.V. .d.o.s.y.a. .b.i...i.m.i.........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_uk.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):15781
                                        Entropy (8bit):5.306567482773278
                                        Encrypted:false
                                        SSDEEP:384:1RamDXePsF0HwX1Rsd6ml+0HHCiwMmcrSWo2:XamDXePsF0HwXfsYm+0HHCiwM5SWo2
                                        MD5:1E8E91CAD32A6610D54E838C803E93C7
                                        SHA1:073965FDDD20601A8348B548DDB174B832D735B1
                                        SHA-256:EBF67318490F70C765B50B6CC4EB3CD4C0EAB9FF10A19BC44A0489B24CECD834
                                        SHA-512:29C1F790613F0B2D41685F0F6A6B910F66BD61C035F8A5B3CF4B18A7C92E4D221B1DC6C27DE67803E8FE654DE3B3BCEB2746F5B510D9CB79AC1BC943D1D73B38
                                        Malicious:false
                                        Preview:<.d....!..`.......uk_UAB.....MJ......OY......X.A..3.......j.........Q.....8.R.....p.W.>......D....C.....5 ..}q...4...1..3|.C|....V.OY...-...]>..&3..]>..*.......#t......v.Qz........t..6<............"-..|......W....)`.[C....;.p....5...#...2...[E..........v...n..........1...... ...........0$...S..zn...&..*...$..:....,..C....u.w\^..%.......7......8...TD..!...T...!Y......(....N......K....8.q3....p....../+...U..'3......&........s...T.. ...........b....{...1.......1.....6....................-a......)........]..V......W......c.....'.l.E...l.l.E...$.l.E.. ..l.E..9....~.......~......6...7.......,6...a..4....S...c. ^>.........1E....../...........................8.........#....}.K.s......s...'....N...D......7w..n........6...Z....u.......t..\T..+..X5A.....q.C...~.x.....9...~...H...^.......N......L.......M...2i....."..........w. ..%..};...(...o...........0...........J..................#...?..........*F.|....8z..Q5..#...KT....i..9.....@.$.0.9.;. .D.>.@.<.0.B.C. .R.A.W. .(.1.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\Qt5\translations\qtmultimedia_zh_TW.qm

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Qt Translation file
                                        Category:dropped
                                        Size (bytes):9951
                                        Entropy (8bit):5.774304533562878
                                        Encrypted:false
                                        SSDEEP:96:2RHL3+0SNWeYxupp/mptZFp4tiUIHuewNSrNSh5NBBVJV69tDxTZBm59bN/5yQKq:IrkrYsEt14q8YrYLBbJVGDL4xK8NfYI
                                        MD5:0017FC26EB26E431C09349A310AD6208
                                        SHA1:C37FC24AED1827F81D2B2B8C673DC9BDD5CE7676
                                        SHA-256:981492BD3B7A83B280F7DE296BE80D55FC3150A45358F93745E4BE3DDEEC5CB7
                                        SHA-512:55896D19DA1CDDE36201D9B0EE268298CE63CB1F7145762E66E426EACCDAC5F8333FD617986697937EC5F000274BF2F066F38E3CEE879649D35E75CFCC92F034
                                        Malicious:false
                                        Preview:<.d....!..`.......zh_TWB... .X.A..........v.........Q.......Q.....>.R.......W.>..............1...T.C|......OY....y.c....!...]>......]>..........................O...........t.. .........................|......W.......[C....5.p.... K..#................n...7.......r..............<..........zn...z..*.............:.......C......w\^...&............."...TD......T..../...........N.....q3....................s...U...r...T..............b........1...................#.......9.......m.c.....9.l.E...D.l.E.....l.E..#U..6...!p.......b..{4.......a...<. ^>...s.................................."R.#......K.s......s...........!...n...{....!...Z..............=.......X5A.....q.C...F.x.........^...i...N......L....2..M....]......D.......p.w. .....};....y.......^..........J....b.........?.............|...."...Q5...[..KT....i..#.......R.A.W. .(q!j..-.). j.hHh<_...........RAW (headerless) file format.....AudioContainerControl.......W.A.V. j.hHh<_...........WAV file format.....AudioContainerC

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtCore.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1982976
                                        Entropy (8bit):6.605444090115069
                                        Encrypted:false
                                        SSDEEP:24576:iDQwlm099ovDcJ/8Hf1YrZ8exoXpqD1WfK7MBEuaRgnmoD8z4SqUDOsWsJ5/wiGH:iDlmEXwK7MBznZDGj8em
                                        MD5:21609415D185489378FDC43809BFD071
                                        SHA1:C42FEF56FD2CE70CD1FAA64E5662874D2029AAB3
                                        SHA-256:D120FCCEC49797A904595EB739781DE4A5976080D4F6E8BFCA455F186813BB6E
                                        SHA-512:3B1CF23F3BB25E49D12B30468DFDFAC752892FAF26F43F948CF5DFB8EB45ADFAEF62B72B2D6D39EEE807D63D306A8DA72709A5A2654E51A046D50744CE6B2E34
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.B*..,y..,y..,y..y..,yF.-x..,yO.-x..,yF.)x..,yF.(x..,yF./x..,y..-x..,y..-x..,y..-y.,y..)x6.,y..,x..,y...x..,yRich..,y........................PE..L....i%e...........!................i........................................p............@......................... ...L...l.......................................|[.......................\.......[..@...............t7...........................text.............................. ..`.rdata..............................@..@.data........P.......4..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtGui.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2022400
                                        Entropy (8bit):6.666787807656882
                                        Encrypted:false
                                        SSDEEP:24576:yxkbwbo6E2S2IQ9Vx83ZLj2EC/GYK8Wfyx61ZWe18hG:prpxi61T6
                                        MD5:F72EB5F6A046D9AA50AB0A41C88CC09B
                                        SHA1:7285E4575CA6742430F76AB383B32D3FA0539C1D
                                        SHA-256:9E8655831F3C3332D451D93AE059DA9AE704B222ACBE6455A7890D25CABAECC5
                                        SHA-512:7698825724904BB8C78969F509D87D1BF66147BFA3C5E3F8916170D1FD4735A7D02EA10EB2A658BB7B9D6C8C1C105ECA284A2472E57A78BA265A7D587CEF8991
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.................5.....B.......K.......B.......B.......B..........................].......................Rich............................PE..L... j%e...........!.........6.............................................. ............@.............................L........................................o...i...............................i..@...............4=...........................text...=........................... ..`.rdata..............................@..@.data...,...........................@....reloc...o.......p...l..............@..B................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtMultimedia.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):736768
                                        Entropy (8bit):6.518668790566688
                                        Encrypted:false
                                        SSDEEP:6144:SUjLOR+AfmVh9Rv8DvgUGtuqPYldhiYXtFwMRBJV57ukR27rifYyu2gQX9//TreF:qR+AuRXl3YdtBjKpGH41P1T
                                        MD5:18C5FF0698F514AC2F3063CFE9D86324
                                        SHA1:A577F195E3BA007CB012EB51CD4FAAAB8141B041
                                        SHA-256:F2A0323F856E90EE55BCFA7A965AE030F0CEA0B28CFDBA200660CF5D38DC116D
                                        SHA-512:926655B1F3061274928293A406CBAF39240B3105ADFA4C63758DECC759A16A324FBF157C30D384A7929808054F6B73AD3103A6C1AC9F063BD7C8562D42D7F6C8
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.r...!...!...!.g.!...!.j. ...!.w. ...!.j. ...!.j. ...!.j. ...!.b. ...!To. ...!...!...!.j. ...!.j. ...!.j. ...!Rich...!................PE..L....j%e...........!.....T...........W.......p...............................p............@......................... ^..X...x^...............................p.......2...............................2..@............p..0............................text..."R.......T.................. ..`.rdata.......p.......X..............@..@.data........p.......N..............@....reloc.......p.......>..............@..B........................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtNetwork.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):566784
                                        Entropy (8bit):6.558511749339486
                                        Encrypted:false
                                        SSDEEP:12288:N/EhG5Fp+mXwSZMB6jlniiuZOBWqVBbEs0HlfqbnV:NshwXMB6jlnyNqb
                                        MD5:A766FC404DDB88C55F4EA8D8073BF2C0
                                        SHA1:46501B3770393C7BCFB2840D491B52E217D03233
                                        SHA-256:B6F3AEB8E0297F25EC37CD66B8600473631140B4BFD60D1C3119B172F89DFD68
                                        SHA-512:451B6FCA2A56D7B53D3E15D96223ED8AEDC5C9A096B10B4FF9BC8F9D11C9D26F31E99564723A9CA8073B97647692EA45EFE2414EFFC7B659C1E72B9AAE7721BC
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... }!.d.O.d.O.d.O.md.`.O.6iN.f.O.?tN.f.O.6iJ.w.O.6iK.n.O.6iL.e.O..aN.f.O..lN.a.O.d.N...O..iJ.f.O..iO.e.O..iM.e.O.Richd.O.................PE..L....j%e...........!......................................................................@..........................c..T...$d..................................@....P...............................P..@...............|............................text...2........................... ..`.rdata...m.......n..................@..@.data.......`.......L..............@....reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtPrintSupport.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):200704
                                        Entropy (8bit):6.451056735860483
                                        Encrypted:false
                                        SSDEEP:6144:4Uo3QTpDjqhgaxbZBgId8Bdq5+OZsMwVadqk0Jxk:Ho3H8Kik
                                        MD5:760EC3E14BAE77160CE97DB6149C4894
                                        SHA1:66264513E4BBE59D0D03F7C177E5B8CE7707A9AE
                                        SHA-256:8209FF8EA4C864E2FCD1FA90B6635D619FD3B67F2022DD4F30A487AE25DBE0FD
                                        SHA-512:7E1200A07E86DEEE3602C1A598E1E78821AA931E9EC3FA60123589E1088BABD4813CFCB2672B10CD41F382D5D13208A60B11A4673E1CB1B88A3B160EA05E8A6B
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B.....................................................T..............................Rich...........PE..L....j%e...........!.........>...............................................P............@.........................Pr..\....r...................................C..4e..............................Pe..@............................................text............................... ..`.rdata..~...........................@..@.data...04.......2..................@....reloc...C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\QtWidgets.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):4016128
                                        Entropy (8bit):6.554254317806606
                                        Encrypted:false
                                        SSDEEP:24576:o/OciWYCGBjmGJpHzrZr9MV7vNPDmAg0gT5ITHFfvwsbxs8BN6OPeHSBNM0c4E1/:yAhrZA7VNv1c4EZL
                                        MD5:7DF4352378289E01C7F83D68FEC6BABC
                                        SHA1:A5733C04CC0198420386ED2EA75795AEF59B9257
                                        SHA-256:F81DBD368384F1D0DBA677EB6BE12206D2A31F6DA120ABD8BEDB6BFF612DE6B9
                                        SHA-512:8871A008FB43BF154F599F4CBE435609EFFD8A5CE6D2B6271C51F22E5E1C297915FBDF217AA5950AF60D53D1E83FB18DD27451C2C8612841092D802D35E5C2AA
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................:..............................................Z.................................Rich...................PE..L...Aj%e...........!......$...........$.......$...............................=...........@.........................../.T...d./...............................7.h......................................@.............$..\...........................text.....$.......$................. ..`.rdata..`[....$..\....$.............@..@.data...0.....4.......3.............@....reloc..h.....7.......7.............@..B........................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\PyQt5\sip.cp310-win32.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):94720
                                        Entropy (8bit):6.461428241926437
                                        Encrypted:false
                                        SSDEEP:1536:cSkWOqWw+FD4BXybYeosVmUBOSMZraWl/HzJOLFgGPizWrcfUPrhNLsOsmRyLMsz:sWOHDFEdBRStWFTJO1ayIinRyMss3Yol
                                        MD5:52B89F57276FF69B6F5EAFB1E23E372F
                                        SHA1:E24FC90391A33228674CA5D3E23C466F78C49B8B
                                        SHA-256:DAFED1ADDD8A8195B1F7FB4A5A46F89900025A0FCD46932520F7AEB20A354BF4
                                        SHA-512:DA79EDCB64DAD0550EF676369B59E606C7B763D306EC431D77A43AD5CC5AE605704BAEE5E3B210FB6CBD00C28B4EDA1704DCF973FCC04E04601BA0A04BFB0417
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..wQP.wQP.wQP...P.wQP..PQ.wQP..PQ.wQP..TQ.wQP..UQ.wQP..RQ.wQPJ.PQ.wQP.wPPEwQP>.YQ.wQP>.QQ.wQP>..P.wQP>.SQ.wQPRich.wQP........PE..L...>.#e...........!.........d............... ............................................@..........................D..T...TD.......................................?...............................@..@............ ...............................text...~........................... ..`.rdata...6... ...8..................@..@.data........`.......J..............@....rsrc................X..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\VCRUNTIME140.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):76168
                                        Entropy (8bit):6.765544990184352
                                        Encrypted:false
                                        SSDEEP:1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
                                        MD5:1A84957B6E681FCA057160CD04E26B27
                                        SHA1:8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
                                        SHA-256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
                                        SHA-512:5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_asyncio.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):56600
                                        Entropy (8bit):6.701238830377098
                                        Encrypted:false
                                        SSDEEP:1536:FDUfUUn5KdYveu2H7sz9YHIRTRILOnY7SyOPx3A:FDgDn0KPz9YHIxRILOnYIx3A
                                        MD5:252C9B6FCC220FE16499ABF4A8E2A2E8
                                        SHA1:03327874A1153E9FE640E6F5E8D987CCC84034C4
                                        SHA-256:E01FDB89380EBF58700F40DCEBAFCB37F24970C8EA1F33063BDEA873B53E720D
                                        SHA-512:F68C9D043D5EF7A32098DDD9C1622F761F88DA31CA47450AB1D95E51AB8CD06E1658DC57DB150AAF51B682F7F285654E6BBD118B3CA8400BB5B2D461BDC78926
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T....T...U..T...Q..T...P..T...W..T.m.U..T..U..T..U.+.T.m.\..T.m.T..T.m....T.m.V..T.Rich..T.........................PE..L...9.,d...........!.....R...\.......V.......p......................................B.....@.............................P......d......................../..........(...T...............................@............p...............................text...TP.......R.................. ..`.rdata...7...p...8...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_bz2.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):72472
                                        Entropy (8bit):6.8432832170573255
                                        Encrypted:false
                                        SSDEEP:1536:QxDhX4Vb2zMIsTRGxT+0q8i9qK5ILCVwQ7Sy8Pxer:mhi2zvsCK0ti9qK5ILCVwQ6xw
                                        MD5:5C952E57426E429F6F4CEC9FEB841815
                                        SHA1:83BFD2108E188909C7FF3B294AB9C99336D02D06
                                        SHA-256:B682E9E8152036BDEBF4CA5410D3C0F88FA3272A969830F63C7B61BB1F0DA89F
                                        SHA-512:2B6AB5F24E7E232C8906AC12C5A4994CFCF1B061FFC25407F278DE3D97664716C24E58237EE6EC48949AC6C1F4522AA1CA4C5238015D128E3A9BE602D2CE0ED2
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.:...i...i...i.svi...i.~.h...i.d.i...i.~.h...i.~.h...i.~.h...i.~.h...i.s.h...i...i...i.~.h...i.~.h...i.~.i...i.~.h...iRich...i........PE..L...Y.,d...........!.........D.............................................. ......!.....@.............................H................................/.......... ...T...........................x...@...............8............................text............................... ..`.rdata...-..........................@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_cffi_backend.cp310-win32.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):155648
                                        Entropy (8bit):6.63555006600095
                                        Encrypted:false
                                        SSDEEP:3072:VeqZA3oBbzbl0uLOEshrI/hTR6wlu556DXbU7xxyTL3qyAUHPN0s:4oA3RuLpshrQlu55uXbmxyTL6yDHPK
                                        MD5:84E1F73A3E4E6D4B6AFD8D9EF10B1924
                                        SHA1:5BD989147215F91D0FD2A17C23D02BBF9FAC89BF
                                        SHA-256:FF874A41DC5D656BC24E48D5193345C09281EBFB7EF7724EF760FC9B1FF37439
                                        SHA-512:57C66BB7AF04512BDE04AA82F75087D2B7F5A82B67B59E860DAA4A660E046891CBE62309B05305D725F71C30DEBFD2829068485164BC46F106355DD79BF5CDCF
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p..Bp...p..q...p..,p...p..q...p..q...p..q...p..q...p[..q...p...po..pW..q...pW..q...pW..p...pW..q...pRich...p................PE..L...<..e...........!................-.....................................................@......................... %..h....%.......p........................... ...!.............................. !..@............................................text...M........................... ..`.rdata..4...........................@..@.data..../...@.......$..............@....rsrc........p.......<..............@..@.reloc... ......."...>..............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_ctypes.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):108312
                                        Entropy (8bit):6.644234290397436
                                        Encrypted:false
                                        SSDEEP:3072:qS6mSAe9tVW/dhyGfnH/Jt5Phld/7VILLPf17Mxk:qS6mzInWlhyiH/Jt1d/7wJ
                                        MD5:FF0992DFB0D4D90BDCEAAD68246C5C22
                                        SHA1:3508B7D730DDE3DB94AE413625451AE8CAA0BD7D
                                        SHA-256:F879F86BF65CE05EE3467DF65C55B9837F9DFFB0F024C350C9A9869A08609759
                                        SHA-512:8BEBC01958D71B327CBC39ED04BC53F6484CAA0232A1FD71E6691BDAA89FCBC766BC888D45870DC24D1190C48A0AE0A58C447EC936E34DB23059EE6F35A138BB
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H..............................................Y........&................$..........Rich...........................PE..L...W.,d...........!................................................................)]....@.........................P4.......4.......p...............x.../.........../..T............................/..@............................................text...!........................... ..`.rdata..TK.......L..................@..@.data...l....P.......:..............@....rsrc........p.......V..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_decimal.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):195864
                                        Entropy (8bit):6.894532348319941
                                        Encrypted:false
                                        SSDEEP:3072:HJwcAu1LgDNsFyrbz5arkp1Lq00rBCXN4hmuqaxgU3pJMWlXgWcW+33SgRILOqXv:HNAg8rRaULECXN4Quqax33XMW5gJW+34
                                        MD5:FBE8BB3048DF17FF9DDB0972825FDA71
                                        SHA1:E3AD65446B60554CB9F7C45700BE2EAD1453772F
                                        SHA-256:283AA604D532B6239AA8D8794C8D8A4F3A11C93DFBCEF846315CFD74F5E07E2F
                                        SHA-512:48C66F10F9E79359DF63FD381C21B4559438DAE7AD84C625EFE1C7AB802F31BB8D326650F654C8EA504791595D801679A6F156F7ED90DA98AEBC04D2120C90A6
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m<.c)].0)].0)].0 %"0'].0{(.1+].0{(.1%].0{(.1#].0{(.1-].0.(.1*].0b%.1+].0)].0.].0.(.1&].0.(.1(].0.(N0(].0.(.1(].0Rich)].0................PE..L...E.,d...........!................(........ ......................................R.....@.............................P...`............................/......t.......T...............................@............ ..d............................text............................... ..`.rdata....... ......................@..@.data...x...........................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_hashlib.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):49432
                                        Entropy (8bit):6.749500211425154
                                        Encrypted:false
                                        SSDEEP:768:H+OYENKnr4deUNXT1Ee20RILOIS5YiSyvWPxWEa1E:HbYENsr4MWT1Ee20RILOIQ7SyOPxl
                                        MD5:2AC2DEE9FDB32BE30FEFD4FDB5D280B3
                                        SHA1:5E803C5D649521CAB34BFC7EF6DC44954915220D
                                        SHA-256:F10C90062EAA68F41B1A6B34F3796E3AB8E0D765E595236E893CFF9FAD30116A
                                        SHA-512:86A7DFE6F15FCE67ACCBC84262C73D25F2E440B7529143235B9B32F15F7804F99206E24C5ED8E5219BB5895BF6E397304BA153E064FF97EED23F5E92469E901E
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.&...H...H...H.......H._.I...H._.M...H._.L...H._.K...H...I...H.F.I...H...I...H...I.H...@...H...H...H......H...J...H.Rich..H.........PE..L...q.,d...........!.....>...T.......C.......P.......................................+....@..........................w..P....w.........................../..........(s..T............................s..@............P...............................text...t=.......>.................. ..`.rdata..j4...P...6...B..............@..@.data...h............x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_lzma.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):148248
                                        Entropy (8bit):7.03034519275223
                                        Encrypted:false
                                        SSDEEP:3072:VcSEmJbTMWUCFHRQWtwjEYZLlFrFvIB+hBJQ8T374Tu2d//zHf39mNoBJNWQ5ILt:GwUC9RQWtwjEGgYXT3CTvYOVWQI
                                        MD5:6174470C775AD7529891E1BA3C54F87B
                                        SHA1:A1536BDECFD42F99BD1CC561EC727D81F613D205
                                        SHA-256:E1E346F8B9FA43EC5519166D92625168EBB642A70F52611545117631C74181BD
                                        SHA-512:0595EA1C8D2784D1C8272E29D8E9C1C074FFA1CA14116AE7E65C52DA1D1E87A0AE1FD9D3EF285F887A8847008DA1EBE3E1F6ACF1294AFDC9E2F31216F7AB7CB4
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.P.D.P.D.P.D.Y...T.D...E.R.D...A.[.D...@.Z.D...G.S.D...E.S.D...E.R.D.P.E.1.D...L.j.D...D.Q.D.....Q.D...F.Q.D.RichP.D.........PE..L.....,d...........!.....f..........<k.......................................@.......C....@.............................L.......x.... .................../...0..t.......T...........................H...@...............x............................text...[e.......f.................. ..`.rdata..b............j..............@..@.data...H...........................@....rsrc........ ......................@..@.reloc..t....0......................@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_multiprocessing.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29976
                                        Entropy (8bit):6.798507676792536
                                        Encrypted:false
                                        SSDEEP:384:aQJATEdgw8HYcj4HjzjuRTBax6i+5/ZMILWBLCHQIYiSy1pCQHcPxh8E9VF0NyUC:9kHYDs88HFZMILWtY5YiSyv8PxWEaC
                                        MD5:7AB685D3F467C7029DEE1A943BB19065
                                        SHA1:BCADE206E6863874EAF72A1CAA748FBDEE916970
                                        SHA-256:91889BBF6DFADFC026276141A4260D7F2C19090FDE9EE04490B9211DD3933EBA
                                        SHA-512:D8E8CABA0D030FA0433D71D376608ACA2DA003D76C67FE9AB8C7B7E4A6AA7E0C21454E1D45CD052BB67B681B57094BDFA9CD634C1A1AE22C104568D20D13B02A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ Nb.A 1.A 1.A 1.9.1.A 1.4!0.A 1.4%0.A 1.4$0.A 1.4#0.A 1i4!0.A 1.A!1.A 1.9!0.A 1i4(0.A 1i4 0.A 1i4.1.A 1i4"0.A 1Rich.A 1........PE..L...D.,d...........!.........,...............0......................................./....@.........................P<..`....<..x....`...............F.../...p.......7..T............................8..@............0..H............................text...t........................... ..`.rdata.......0......................@..@.data...`....P.......4..............@....rsrc........`.......8..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_overlapped.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):42264
                                        Entropy (8bit):6.794037552069512
                                        Encrypted:false
                                        SSDEEP:768:Hv9eDBCwgCnLEggqKboqjzezQPxNILXtV05YiSyvdPxWEaoC:FwgULj8NvezQPxNILXtVe7SylPxRC
                                        MD5:0A4AAABED72E8E08143EB129E5E24407
                                        SHA1:A85094E29FE1DE755DFB2BB2650378CA7BD1F5F2
                                        SHA-256:2233C561A18D92ADC2F4C56D6C55ADFB4A01049E801BDD3BB2A03CEE125F6E43
                                        SHA-512:79942D76D23376C71028EED8658E2C938DFE64D54D56FC60C0CA8F2FCA9515D7A5A24A5ABFDCB51DFF944ED2F7BEB17B6D5BA50D45A62DE9A7DB4FDCF6A04F62
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..f...f...f......f...g...f...c...f...b...f...e...f...g...f...g...f...g...f...b...f...n...f...f...f.......f...d...f.Rich..f.................PE..L...H.,d...........!.....8...>......]<.......P......................................{.....@..........................h..X...(i.......................v.../......$...8d..T............................d..@............P...............................text...$6.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....rsrc................d..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_queue.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):28440
                                        Entropy (8bit):6.828727954203399
                                        Encrypted:false
                                        SSDEEP:768:gtbUDut6rf1vYvVILQUG5YiSyvhPxWEa4:uUa8f1vYvVILQU87SyJPxp
                                        MD5:2E6FE907E37F3F9154DB187C1B7F8232
                                        SHA1:77F25B5D95097DFDA0F9FD58632F8711091547CD
                                        SHA-256:763D333C80F4C11861C9210C4BD53FEDA24B5598AC9270391B2EC250BD52B636
                                        SHA-512:D87683A681D576CB334BDF2CE385E6BDB115D18232E160F17535A6BA432342604ADE6404F085F64ECA63C639860968603D4D8DB11A11520A1BC44B2A57FE00AF
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p..p..p....p...q..p...u..p...t..p...s..p.m.q..p..q..p..q...p.m.x..p.m.p..p.m....p.m.r..p.Rich..p.................PE..L...H.,d...........!.........*...............0............................................@..........................<..L....=..d....`...............@.../...p..\...`8..T............................8..@............0...............................text............................... ..`.rdata.......0......................@..@.data...@....P.......0..............@....rsrc........`.......2..............@..@.reloc..\....p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_socket.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):69912
                                        Entropy (8bit):6.7529275237414
                                        Encrypted:false
                                        SSDEEP:1536:XAqVY6E4oksA1MT9f8+CeJ+8WyKTVVILLwt7SyJPxl:XAqVY3FA1MT9f8DeJ+8W9TVVILLwtvxl
                                        MD5:A092B2DE9E1128F73E26D142A5B2D68B
                                        SHA1:0C5E38B11389ACC870056200710F4152FBB03429
                                        SHA-256:389D2B94A3562879F9E0A17CACE1574EE308AC39A5D9F5659F885284C9B2D19E
                                        SHA-512:60D45D3BEF3C8729CA879816A321B8508AE304A84499E715CB2AD7352273A6482B82C960092311E3EF40F1326D6533CE25B61953A197F7D3FBCE2C0CF511D5E2
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...f...0.`...0.n...0.h...0.c.....`...b......)...e.....c.....c.....j.c.....c...Richb...................PE..L...n.,d...........!.....f...|......tk....................................................@.........................P...P................................/..............T........................... ...@............................................text...:e.......f.................. ..`.rdata...Z.......\...j..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_sqlite3.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):72984
                                        Entropy (8bit):6.755617527508713
                                        Encrypted:false
                                        SSDEEP:1536:a85mWPlKtIGSqpnoOUNGHxvttnGyOuPrF2dRILOQxyO7Syo/PxjP:XmdiHqpjmGx1tnGEzF2dRILOQxheHxD
                                        MD5:389A85E60B7DA2F29AAA738A7BF2B542
                                        SHA1:4C6F51FD4C25F22474667AB8078AD974A9628C5D
                                        SHA-256:8A703DA286CDBC263FE28D0888C03BB899E73B4B7729C44A953CC6139F33E3BE
                                        SHA-512:898506A70DA25E8D181DF7E7790430ABEFCB0C9EECCB0595A1983CE09B6155DD0C72935470FBB9EF0BFA0BFFC953555693FF2FFA2461C10B84578691CD0C7B50
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7@..s!.]s!.]s!.]zY.]u!.]!T.\q!.].Ny]r!.]!T.\.!.]!T.\y!.]!T.\r!.].T.\v!.]8Y.\q!.]s!.].!.].T.\z!.].T.\r!.].T{]r!.].T.\r!.]Richs!.]........PE..L.....,d...........!.........n.......................................................I....@.........................P...P................................/......8.......T...............................@............................................text....~.......................... ..`.rdata...E.......F..................@..@.data...L...........................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_ssl.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):141592
                                        Entropy (8bit):6.519132347042123
                                        Encrypted:false
                                        SSDEEP:3072:Q1ixmpACRnjX8bpl/u3O90wxY77N5ILC792oywBxv:4ixmpPsbppu3zwxWN9b
                                        MD5:1222DAA5C49F53A36D2843CA9BFE513A
                                        SHA1:7A43E326B261E75A05CDFA979B80E95B69080173
                                        SHA-256:69C76B8FE5C873D1A0DFF493C3A3B88090B61EE648AD7681BC0581964465589E
                                        SHA-512:B5BF384D14C3C8221A42288F97D910491730C84BE0A783F5BD17FC2E3DF7F2BB63529571C97CB08064066AA90F07FA00C837944E43DB62E071089A720A8BB551
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>...F-..>...K...>...K...>...K...>...K...>..=K...>..8B...>...>..r?...F...>..=K...>..=K...>..=KA..>..=K...>..Rich.>..........................PE..L...~.,d...........!.........L......t........................................ .......P....@..........................q..d...4r.........................../..........Pm..T............................m..@...............,............................text............................... ..`.rdata..............................@..@.data....J.......H..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\_uuid.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):22808
                                        Entropy (8bit):6.937211239543495
                                        Encrypted:false
                                        SSDEEP:384:vqIesePwjnE8Gtr5ILZwkeHQIYiSy1pCQiI/NPxh8E9VF0Nyn54qSc:CIeZkgr5ILZwkU5YiSyvT/NPxWElQc
                                        MD5:59F19A807B3E13D8E707C942A38BF84E
                                        SHA1:469DEC6DA89737795C72FF51F69B44462E55099A
                                        SHA-256:7ED17311B391FFFF58F073ECF71829F73629033458A54A435DC62014281A733C
                                        SHA-512:3C10A7B3AF03E1AE95C577FB4FEE108D0ACFF876DFE0FD1079F74DE30881B5F3659AAA1F52A857CEC9C7430248094E896261C297A25C62D4951252A3A74EB48A
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..:...:...:...B'..:...O...:...O...:...O...:...O...:...O...:...B...:...:...:...O...:...O...:...OK..:...O...:..Rich.:..................PE..L...M.,d...........!......................... ...............................`......5.....@..........................%..L....%..x....@...............*.../...P..l.... ..T...........................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..l....P.......(..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\base_library.zip

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                        Category:dropped
                                        Size (bytes):1066352
                                        Entropy (8bit):5.6712348464357385
                                        Encrypted:false
                                        SSDEEP:12288:cgYJu4KXWyBC6S4IE/8A4a2YaRxdOVwx/fpEh+rg3u+E0SLMNJ:cgYJiVB+La2xkVwx/fpEh+Iu+E/MNJ
                                        MD5:F2462FAB571A87A8C1884B186CCCAB73
                                        SHA1:13022B2FA4F83EC218E024A85E97454D8DCA2385
                                        SHA-256:4872929FFBAF2FC9F0598DB66B6FEA94EFC58960CA6AFBB1A82EA1E518830991
                                        SHA-512:B43FB2A80057B86DD4E58D86C7F69373259DC0DD76E21FAA3B23E38226CBCBF5D023CB45BE8E7591210BD96816136B21C12FBD870DFE57E1933C22F171F774C1
                                        Malicious:false
                                        Preview:PK..........!..,..5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\backup_commands_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3851
                                        Entropy (8bit):4.982326391283038
                                        Encrypted:false
                                        SSDEEP:96:OxkNmfIDg1E8zcwkGOIV9WdkgrRhYLVBHrJPIV88grwSzK:TgQsa84wPV9WdPrRhKVtrJAV8HrwSzK
                                        MD5:6988EF78588BD0E8209E9CC8B5D342E3
                                        SHA1:1533EEA95F7D228D6BC2E9E594ACF83119A79666
                                        SHA-256:413EEC4E1B878D16DFC846D7164DD016253F9F30EECE914809D2E23EB66F2355
                                        SHA-512:B236DF28460E052B10717250D151F13F781DFA24B0FB8178D6CCD1CAFD91419CB4EE355F1B1FA9164CA103EC281C0F66CA3FD365CD13B469F1D200EDCE440774
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class CheckBackupRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. SILENT_FIELD_NUMBER: builtins.int. silent: builtins.bool. def __init__(self,. *,. silent: builtins.bool = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["silent",b"silent"]) -> None: ....global___CheckBackupRequest = CheckBackupRequest..class CheckBackupResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. ID_FIELD_NUMBER: builtins.int. id: typing.Text. def __init__(self,. *,. id: typing.Text = ...,. ) -> None: .... def ClearField(self, field_

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\bitbox02_system_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (309)
                                        Category:dropped
                                        Size (bytes):5248
                                        Entropy (8bit):5.0699310653475695
                                        Encrypted:false
                                        SSDEEP:96:nGkV76NTnaQGpXW/CEI569BaWei1Am0d3gGI4Dzl+iG/hiV0XW9zeasQjjV:d54ja5W/BI569uiCZd3lzgzY2W961EjV
                                        MD5:A17DDB62F276DBB561B515918DDC95EB
                                        SHA1:63370BA2A706796E779CAA3C6534B09F5684F002
                                        SHA-256:54D2D6921A78180D974870386EC4E9C6F0F50CDD7B3C0C5B3D8E88615A760FFA
                                        SHA-512:83819E50975DA79B483B6240BCBC5F0E5CE2C1A44794D48A4C3225A4801205104A2EE207F5ABC86D571DA76D32C7D9E07722820064C658543A8DBB8DB7FC5D1D
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class CheckSDCardRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___CheckSDCardRequest = CheckSDCardRequest..class CheckSDCardResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. INSERTED_FIELD_NUMBER: builtins.int. inserted: builtins.bool. def __init__(self,. *,. inserted: builtins.bool = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["inserted",b"inserted"]) -> None: ....global___CheckSDCardResponse = CheckSDCardResponse..class DeviceInfoRequest(google.protobuf.message.Message):.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\btc_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (388)
                                        Category:dropped
                                        Size (bytes):33375
                                        Entropy (8bit):5.136269727408597
                                        Encrypted:false
                                        SSDEEP:768:2FSyf8CT3THDKoTScSFPNG730gzFNsdlXMM87Uqu9qmjv/Lqr2XE58TS6fFyHTST:2FSyf8CT3THDKoTScSFPNG730gzFNsd7
                                        MD5:AA42E66D765C8193D5E21F3FBC96992B
                                        SHA1:E368061C6A2401DB353624402C71A4D1CF3D8668
                                        SHA-256:7616DB88EBC403644E3ADFDE37ACBA44FC3EEB881E07838F82FC1A89B480A8BE
                                        SHA-512:5161DF99A69710C2A827024E7D8C1F26BD0D94ED56865C4E2030DF2C46912227F1DD1DB94E53CFE065DE9E4843C2AEFF019299D46D702B245A31D0705327BEE9
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import antiklepto_pb2.import builtins.from . import common_pb2.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class _BTCCoin:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType.class _BTCCoinEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_BTCCoin.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. BTC: _BTCCoin.ValueType # 0. TBTC: _BTCCoin.ValueType # 1. LTC: _BTCCoin.ValueType # 2. TLTC: _BTCCoin.ValueType # 3.class BTCCoin(_BTCCoin, metaclass=_BTCCoinEnumTypeWrapper):. pass..BTC: BTCCoin.ValueType # 0.TBTC: BTCCoin.ValueType # 1.LTC: BTCCoin.ValueType # 2.TLTC:

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\common_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3152
                                        Entropy (8bit):4.9931742238287145
                                        Encrypted:false
                                        SSDEEP:48:OKX8xO9Ie9coB87F8qDO4LyBcjhmlP7OpOhONOPONpNpBwBG5eBKBcwqRqaaZ+3q:OC6JadBGFD5+nlDoycKGvwGcWBmzvPsB
                                        MD5:475776E2B63777A766E1121F4E7F0DA2
                                        SHA1:C393E11514C2CA8DEFE5B102AB89D5ED344DDC52
                                        SHA-256:A81614BF23A09597C6CA2F96EAC36BE27F65FF743E872919F45E7440DD367F45
                                        SHA-512:668D76C46827E0D2E308C92E29AB3049B5B0738463836F4BC0A18CA44605D3A75EFABA97160B522644F1BDCA4CC5EE4E58E4CC09870E6ACD1F8AACD8D2AB2BF8
                                        Malicious:false
                                        Antivirus:
                                        • Antivirus: ReversingLabs, Detection: 0%
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class PubResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. PUB_FIELD_NUMBER: builtins.int. pub: typing.Text. def __init__(self,. *,. pub: typing.Text = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["pub",b"pub"]) -> None: ....global___PubResponse = PubResponse..class RootFingerprintRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___RootFingerprintRequest = RootFingerprintRequest..class RootFingerprintResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\eth_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (309)
                                        Category:dropped
                                        Size (bytes):19589
                                        Entropy (8bit):5.09832628113467
                                        Encrypted:false
                                        SSDEEP:384:YA1AbKmuBTqCcKEn6u6T86uwORnAJR5vbPbTSV6s6oi7+J5JsRtHy:YWAbKmuBTqCcKEn6u6T86uwORnAJR5vw
                                        MD5:1D34C55C7121BD3695CFC6C73381DC0C
                                        SHA1:1AB53605573FA267FD457B284AEC6507D7C40857
                                        SHA-256:E45729EF836A6202048AF41997D058846959ED9CA705E434BE6760313E7EF64A
                                        SHA-512:590DB0ECABA1470D60710649E363E49D8496EA205BBE2E522D788BBB288916740D86D68C44ECAD83B00C985F28B74604E3A430E879694727CE909ED278824710
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import antiklepto_pb2.import builtins.from . import common_pb2.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class _ETHCoin:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType.class _ETHCoinEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_ETHCoin.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. ETH: _ETHCoin.ValueType # 0. RopstenETH: _ETHCoin.ValueType # 1. """Removed in v9.14.0 - deprecated""".. RinkebyETH: _ETHCoin.ValueType # 2. """Removed in v9.14.0 - deprecated"""..class ETHCoin(_ETHCoin, metaclass=_ETHCoinEnumTypeWrapper):. """Kept for backwards compatibil

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\hww_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable, with very long lines (926)
                                        Category:dropped
                                        Size (bytes):13514
                                        Entropy (8bit):5.139264229998885
                                        Encrypted:false
                                        SSDEEP:384:Gqw/WO8nXG7KgysmifAs21OgFNwnyGmGAWHWq4atFxxuxhc+cNfSv8YisYFDGcCu:Gqw/WO8XG7KgysmifAs21OgFNwyGmGAK
                                        MD5:1F4404FED86A2D3B1052A995C06B1DAC
                                        SHA1:548F5125246006890A6D2CAB0B9AFB09ABBCADAB
                                        SHA-256:B7D6EA2DBFA9FB758ECD6F0D90ECA2878AAFB23503E4791F0D7077457CE89A46
                                        SHA-512:2BC7B255562628C0FCF364DAE38C89C88EC25680CF1B5A7EDD52C0F89747B5863F4946DC3467EF62154586D0CC46AFFB8840765C9B33A338C6F742E56EA5F2C7
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import backup_commands_pb2.from . import bitbox02_system_pb2.from . import btc_pb2.import builtins.from . import cardano_pb2.from . import common_pb2.from . import eth_pb2.import google.protobuf.descriptor.import google.protobuf.message.from . import keystore_pb2.from . import mnemonic_pb2.from . import perform_attestation_pb2.from . import system_pb2.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class Error(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. CODE_FIELD_NUMBER: builtins.int. MESSAGE_FIELD_NUMBER: builtins.int. code: builtins.int. message: typing.Text. def __init__(self,. *,. code: builtins.int = ...,. message: typing.Text = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["code",b"code","message",b"message"]) -> None: ....glob

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\keystore_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1308
                                        Entropy (8bit):4.960417044026867
                                        Encrypted:false
                                        SSDEEP:24:kGrF3aHNKtG1rZ4ntdmZBEOdAMkFLJAYMcXCQ/iMdmZBpOjSAlTcXQixiTn:OKf8EOZ6sciY8pOWyclET
                                        MD5:7926D8BDCCFEA930CBD2A2FB28298C9F
                                        SHA1:6139C9CD1F56BE76C6E1DEE73079BA22696AFBBC
                                        SHA-256:AB23047FFF35ED2B7FAE0283375992BE60D501CB3F0B0053CB97770FE31543E9
                                        SHA-512:4A28958F6165C860382BD9491E461E3A11DACBEFD84D269602DDA0FE1D920EF7325E44B1265A13A87793C66AF325E1F4B416B6364B72D35A34B8CEA7DE79C18E
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class ElectrumEncryptionKeyRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. KEYPATH_FIELD_NUMBER: builtins.int. @property. def keypath(self) -> google.protobuf.internal.containers.RepeatedScalarFieldContainer[builtins.int]: .... def __init__(self,. *,. keypath: typing.Optional[typing.Iterable[builtins.int]] = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["keypath",b"keypath"]) -> None: ....global___ElectrumEncryptionKeyRequest = ElectrumEncryptionKeyRequest..class ElectrumEncryptionKeyResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\mnemonic_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1541
                                        Entropy (8bit):4.953918413828606
                                        Encrypted:false
                                        SSDEEP:24:kGrF3ayGrZ4TdmZB7AmdmZBkOXOavzRAwUwcXVZ1vThz1dmZB/OE17AS0cXQz0zy:9x87L8kOXOwzRcwcRR8/OEZB0ca
                                        MD5:878BA6A31A34C344BFC3D7F916C21857
                                        SHA1:9E56171DDCAB1412974020AF7ADEDA116D327A8C
                                        SHA-256:22EBFAA989850D8A759F23304D66BF975C15D9CD0B8CD59EEAFA01A2A474DA72
                                        SHA-512:DD20C9446B1B6A4B72668DBE563D21932745026CB1AB553E1E568FF6C0E5526E4EB9338136CB3D72EE46DA7D98F117D721FF2D5F490FD857CB81232B4AB8E4AD
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.message.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class ShowMnemonicRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___ShowMnemonicRequest = ShowMnemonicRequest..class RestoreFromMnemonicRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. TIMESTAMP_FIELD_NUMBER: builtins.int. TIMEZONE_OFFSET_FIELD_NUMBER: builtins.int. timestamp: builtins.int. timezone_offset: builtins.int. def __init__(self,. *,. timestamp: builtins.int = ...,. timezone_offset: builtins.int = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["timestamp",b"timestamp","timezone_offset",b"timezone_offset"]) -> None: ..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\perform_attestation_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1990
                                        Entropy (8bit):5.024193639757406
                                        Encrypted:false
                                        SSDEEP:48:9VwDXOi+69BcnVwYOB/OzOVOOOvYjMB63BxKBlMpBUBfBcSckUw:PAjT+Vn20YRkKw6x8lQE5PUw
                                        MD5:FA9B13FCDE2A27D056BDCF511923EC4F
                                        SHA1:DF9598AAFFF3BCB14870D8BB5B155B23687C1E17
                                        SHA-256:7B6C5A3996BFFDFFF9C224FC332635A9D4B9F29D730AF6A3983DAA14123DE79C
                                        SHA-512:1D5C9C4A6B43B440079950BDFBA539D7E980202CB4E34F66160EF56FD39A8F3CD3219EC0087469C9B1F7D38CFD8C5D22E1D1C27F71419EE33962307CFFFD4B24
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.message.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class PerformAttestationRequest(google.protobuf.message.Message):. """Deprecated, last used in v1.0.0""". DESCRIPTOR: google.protobuf.descriptor.Descriptor. CHALLENGE_FIELD_NUMBER: builtins.int. challenge: builtins.bytes. """32 bytes challenge.""".. def __init__(self,. *,. challenge: builtins.bytes = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["challenge",b"challenge"]) -> None: ....global___PerformAttestationRequest = PerformAttestationRequest..class PerformAttestationResponse(google.protobuf.message.Message):. """Deprecated, last used in v1.0.0""". DESCRIPTOR: google.protobuf.descriptor.Descriptor. BOOTLOADER_HASH_FIELD_NUMBER: builtins.int. DEVICE_PUBKEY_FIELD

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\bitbox02\communication\generated\system_pb2.pyi

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1394
                                        Entropy (8bit):4.908402032806933
                                        Encrypted:false
                                        SSDEEP:24:kGrF3aHkG1rZ426dmZBR7FYC9Mfuva/N7SOxa2cC2ZhUn6W/rWC+u6WQDOJVYAHx:NN8R7eX7SnITn6YWC+u6DO06cx2
                                        MD5:D283654C86077E18CD61D581C02894F4
                                        SHA1:2AFF38170C43FF33480D80A93D47094E4258160B
                                        SHA-256:C8AA69CC36271BBF0ECBC5947F10169E97AC65624B244D4D19BFD68E78427CB3
                                        SHA-512:456927D2F2FD5495E04133BA8E89BAC36BC03250BC5BD2AA828642D574BF474A62D77F16E0EF9280C3A3A5FCCEC2835D912EAB02FB79F82C8563753766F4A2EF
                                        Malicious:false
                                        Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class RebootRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. class _Purpose:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType. class _PurposeEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[RebootRequest._Purpose.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. UPGRADE: RebootRequest._Purpose.ValueType # 0. SETTINGS: RebootRequest._Purpose.ValueType # 1. class Purpose(_Purpose, metaclass=_PurposeEnumTypeWrapper):. pass.. UPGRADE: RebootRequest.Purpose.ValueType # 0. SETTING

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\certifi\cacert.pem

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):292541
                                        Entropy (8bit):6.048162209044241
                                        Encrypted:false
                                        SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
                                        MD5:D3E74C9D33719C8AB162BAA4AE743B27
                                        SHA1:EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
                                        SHA-256:7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
                                        SHA-512:E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
                                        Malicious:false
                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\cryptography\hazmat\bindings\_rust.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):5105664
                                        Entropy (8bit):6.747499713859597
                                        Encrypted:false
                                        SSDEEP:49152:rHWs7jO0dKPCZL/CIpNsIf0HszAwDrvibENUffZi97n8gKdDoRSkET7pmfi+zfJg:rHW0OtCZL/C3HsrDibE+fOOouT4qnB
                                        MD5:871133E95B9704B35E6192C136949520
                                        SHA1:B6D0BA578A1CFABB5CCB4169250BB58910984568
                                        SHA-256:8D33F22574E8778C21BD7F395FABDCC996F3E22E91CF0489298499884C88BC91
                                        SHA-512:8DFF4837C8F73090E45927D61FCAF25E7D2DDD20EE29612CA94CFD62E80679EDCF1607B448719121B2ACB1BF55A5C6C9F20E1A9FF9A0D2011B7B1669E83FF3D8
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.......................................................-...........5.........-...e...x...............x.......x.......Rich............................PE..L....f.e.........."!...&.0=.........;.<......@=..............................0N...........@.........................`aJ.p....aJ.|............................@K.......H.T.....................H.....0.H.@............@=.h............................text.....=......0=................. ..`.rdata..XA...@=..B...4=.............@..@.data........J......vJ.............@....reloc.......@K.......K.............@..B........................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\bip39_wallet_formats.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):3308
                                        Entropy (8bit):4.46082568411814
                                        Encrypted:false
                                        SSDEEP:96:EHtrrarfTWeeWxbexSb6mtD2+8+PTWIDVjrTTte+g:zm
                                        MD5:46CA7C7E51E5F0604DEACF218A0F50E8
                                        SHA1:9BB4D19739AB70AD29ED7F94F672B167E7A1CE53
                                        SHA-256:1C5215598A86EFB728754270A91076B653A14D7EAE33BE25C7DE02405E4F329B
                                        SHA-512:C3D64329EEA3B6024E9D0C0241AF88E53A00E32D8BC3E86C5835ED0120294655C1753ECEC8037559CC59D0E42C13E2FE025ED0FA57F04F7A0DD39476A28ED5FC
                                        Malicious:false
                                        Preview:[. {. "description": "Standard BIP44 legacy",. "derivation_path": "m/44'/0'/0'",. "script_type": "p2pkh",. "iterate_accounts": true. },. {. "description": "Standard BIP49 compatibility segwit",. "derivation_path": "m/49'/0'/0'",. "script_type": "p2wpkh-p2sh",. "iterate_accounts": true. },. {. "description": "Standard BIP84 native segwit",. "derivation_path": "m/84'/0'/0'",. "script_type": "p2wpkh",. "iterate_accounts": true. },. {. "description": "Non-standard legacy",. "derivation_path": "m/0'",. "script_type": "p2pkh",. "iterate_accounts": true. },. {. "description": "Non-standard compatibility segwit",. "derivation_path": "m/0'",. "script_type": "p2wpkh-p2sh",. "iterate_accounts": true. },. {. "description": "Non-standard native segwit",. "derivation_path": "m/0'",. "script_type": "p2wpkh",.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\checkpoints.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):65410
                                        Entropy (8bit):3.98763136223524
                                        Encrypted:false
                                        SSDEEP:1536:gvjv9+0ZVWQgy2x8zlOcG3aqGS5ylztlHxNbTv:2C8YYpP3D
                                        MD5:D9E2C5C93CF5036D0E9C6123251A0480
                                        SHA1:042054F9E3CC9C13ED348EB4FC34D531B328403C
                                        SHA-256:1D723ACA3C3C6FDD8C98A12FF65CF24F8BB521FFD60831E1E778C5A843EA3349
                                        SHA-512:4C66113E647CCEAC541626E861088E1EC434EA770AA37D305610F26633714619C4A1FCE71BCEB1989866233BDB7E636468FD80FF76EB177999B62C3983161C96
                                        Malicious:false
                                        Preview:[. [. "00000000693067b0e6b440bc51450b9f3850561b07f6d3c021c54fbd6abb9763",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000f037ad09d0b05ee66b8c1da83030abaf909d2b1bf519c3c7d2cd3fdf",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "000000006ce8b5f16fcedde13acbc9641baa1c67734f177d770a4069c06c9de8",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000563298de120522b5ae17da21aaae02eee2d7fcb5be65d9224dbd601c",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "000000009b0a4b2833b4a0aa61171ee75b8eb301ac45a18713795a72e461a946",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000fa8a7363e8f6fdc88ec55edf264c9c7b31268c26e497a4587c750584",. 26959535291011309493156476344723991336010898738574164086137773096960. ],.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\checkpoints_testnet.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):138404
                                        Entropy (8bit):3.921069131385325
                                        Encrypted:false
                                        SSDEEP:1536:wTfJux0vjeByZDtPsfCNOXcrFasvJa+tngIce4CHIyZjbfHTJr13gR0z:k5ScZaCNTrF3ngXUjrFr13gC
                                        MD5:B050FB77E90ECF4B8235CD5BD1251651
                                        SHA1:B260CFDCC3384D386917DFC04B4690F06A6C6951
                                        SHA-256:9E7B01F5DE5F1FDFC28BA0E638F2723D8DDB6E5CDA041EE662552F7145ECE8D7
                                        SHA-512:3921B806E30DE8FFAB8956005030305D5C9703365BFB3E94D27E16874BCB41394749F986FC0123C716C775A69460F3EBC0AECCDA5743E79F5E79EC7680700C9B
                                        Malicious:false
                                        Preview:[. [. "00000000864b744c5025331036aa4a16e9ed1cbb362908c625272150fa059b29",. 0. ],. [. "000000002e9ccffc999166ccf8d72129e1b2e9c754f6c90ad2f77cab0d9fb4c7",. 0. ],. [. "0000000009b9f0436a9c733e2c9a9d9c8fe3475d383bdc1beb7bfa995f90be70",. 0. ],. [. "000000000a9c9c79f246042b9e2819822287f2be7cd6487aecf7afab6a88bed5",. 0. ],. [. "000000003a7002e1247b0008cba36cd46f57cd7ce56ac9d9dc5644265064df09",. 0. ],. [. "00000000061e01e82afff6e7aaea4eb841b78cc0eed3af11f6706b14471fa9c8",. 0. ],. [. "000000003911e011ae2459e44d4581ac69ba703fb26e1421529bd326c538f12d",. 0. ],. [. "000000000a5984d6c73396fe40de392935f5fc2a8e48eedf38034ce0a3178a60",. 0. ],. [. "000000000786bdc642fa54c0a791d58b732ed5676516fffaeca04492be97c243",. 0. ],. [. "000000001359c49f9618f3ee69afbd1b3196f1832acc47557d42256fcc6b7f48",. 0. ],. [.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\currencies.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):13589
                                        Entropy (8bit):2.9049133687933306
                                        Encrypted:false
                                        SSDEEP:192:07m8rWrq9bzab8rbWrqu6jWBhd8rWrq3/8rno8rbWr7b8rf:0xza5POy
                                        MD5:98F790C46325F2663FB8C4301A762FA2
                                        SHA1:00E1F57575A71C4FE1972DC1A08600399AB936D5
                                        SHA-256:608DEEDC9FA24701E9D1AA834B231CB8DB6EC014FE03353BD589D6BB6B82AF39
                                        SHA-512:B13C175C92C6096BA6360485E378EE030FBC8FAFF525896D3D3445EDCD91120EAAD1C343DAE756C82C641CE80344456AB8248710035AD86132AEA5F9E6B3CDF2
                                        Malicious:false
                                        Preview:{. "BitFlyer": [. "JPY". ],. "Bit2C": [. "ILS". ],. "BitPay": [. "AED",. "AFN",. "ALL",. "AMD",. "ANG",. "AOA",. "ARS",. "AUD",. "AWG",. "AZN",. "BAM",. "BBD",. "BCH",. "BDT",. "BGN",. "BHD",. "BIF",. "BMD",. "BND",. "BOB",. "BRL",. "BSD",. "BTC",. "BTN",. "BWP",. "BZD",. "CAD",. "CDF",. "CHF",. "CLF",. "CLP",. "CNY",. "COP",. "CRC",. "CUP",. "CVE",. "CZK",. "DJF",. "DKK",. "DOP",. "DZD",. "EGP",. "ETB",. "EUR",. "FJD",. "FKP",. "GBP",. "GEL",. "GHS",. "GIP",. "GMD",. "GNF",. "GTQ",. "GYD",. "HKD",. "HNL",. "HRK",. "HTG",. "HUF",. "IDR",.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\Electrum_512.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):174386
                                        Entropy (8bit):7.968500119111208
                                        Encrypted:false
                                        SSDEEP:3072:m4EU4nvqLgn2cQtfeafQuJt5ioqmfdXV11gMdHtTeu:Mvqk2T/Jt5ioLf1V11gMJ8u
                                        MD5:86B79DFCB64DE8DDFFDAF1BED393C9A6
                                        SHA1:C78609FFB571BA419CA1D869BD03CE8A3834B03B
                                        SHA-256:9E68B49C2AA7E6FBF7F456CE20B18BA98D6F85A0161DA240901D4A7DBA464CBD
                                        SHA-512:B7CD296707FEE4B4C3A21989AC613D3994A2E60934372A22B903C0FE9E585CB1940F78DD8D4B93D2CC56BAB5F38908193E18BFA00514C1381B0DC9E4DC84BBB0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\Electrum_square_512.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):175987
                                        Entropy (8bit):7.947889831396768
                                        Encrypted:false
                                        SSDEEP:3072:XXkxLtz/rdEk4jZOGVy/NuguOWsOe0kOYuUDDMCWfU6qbC52XC/PrI7lWt:kPY1KGOWhe0kOcDDTqPq+5NI6
                                        MD5:843B877B6083178C37566EB49012D518
                                        SHA1:3D30E35B39687DF2914EABC70857A986C13D9ADC
                                        SHA-256:780A4BF68902A306C2CE24B8424F68BA91875D99D13EC8A2CF05AAAFA9B23624
                                        SHA-512:C8AA04DFADCE3E34F0B2D00762854E04EF65BC6311058B18B0ECD6DDE6130E004A8626498EF5D21ED8C30C26C685D9CD21CD37BC281A79E16ACEB52AA037763A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\add.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):687
                                        Entropy (8bit):7.377532436950315
                                        Encrypted:false
                                        SSDEEP:12:6v/7JZEVEG9X6fWYJzggenHHHGadWUmvS7jx0HvgutsLK79DoQmRJV9HP8m:saVTAfwJHHH7cS/xKgtLYDon9Em
                                        MD5:306C508E41649D8BFF7C7D8922AA8139
                                        SHA1:3EBABCAF901ADED58811E88A45DD97CAA2060A2C
                                        SHA-256:04D8CDA81A29DA1F0198FE8B2A6FA6537E5FF2F7124EBB61F0CAAC64710F253C
                                        SHA-512:5D1AE05F95E8E59155AA6ADF4A8A6960206200C89F08C7F9D55E5643D08A92D0D26CF0F0290AE29C08F1A02D2CBED9B1093CBD424A0BEBB158B9DB1671554470
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....pHYs.........c......tEXtSoftware.www.inkscape.org..<....<IDATx..=..Q...3w.d.B....."....lk+..'..+......~....#.X.v6+..+.+Y&.c...n2W.r.8.@.9.y&.C.LDU.2.u.k\.u.k\.u.k\.u.k:/...Ln..D......d.E.H........da.R.............tx..p....:f.~..P.....m......`....`....`....`....`....`M......M...;(g.:.JA.U8...&..Py..._.........(=.......m@Q....~.5.r[Y..FK....`7-....}..?.....`."E.)........)...>......E..X..........+.....`<g1..X..RD....L..&,..KI..(z.w....|*..g(_b.Z.....r.:O..._..y..98..J...^@....*.H..;.NJ..J...L.>.x...o.."....X....X....X....X....X....X.y..o...t..'bs.d>..a..jD../...~.Ld...h.vq....M..$."........X....X....X..J.r.q..L....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\android_electrum_icon_background.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1349
                                        Entropy (8bit):3.151366413748389
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPkVsCsyRYTZDn+sn+FsH+sH+sn+FscPsH+sn+FsH+sH+sl+sH+sn+FsH+sV:6v/7klBRYTZDJ
                                        MD5:EB7D708191A38F982841DB110BDBBE89
                                        SHA1:46D751BEDE5751B188B3227581ECCF959855300B
                                        SHA-256:02A6F4521D0656103369D6CE3EAF7E314289B342F8B67DB00592A3C409ED6D80
                                        SHA-512:B0A9C9F106BF2AE9AC57C30AC195669BFF31B32D86837FA9D61B48A2854E41277D7B4FA70545FF762F51FC703234383429086D35EAEFAD7B540F5E122440D7C4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............N0*....IDATx...1.......7.*8Hz...U..<$...................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``.....................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``.....................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``..................................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``. ...................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``..............................`

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\android_electrum_icon_foreground.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):23973
                                        Entropy (8bit):7.9504694279167945
                                        Encrypted:false
                                        SSDEEP:384:XkyL4VmLi000d3ui6AWxSLpFipUfWuyVTnl0+n25TT7D3LBwyZ56JwDcHMfG:0Ov+0NFui6AWleWVnO+n25TT/LeyiIX+
                                        MD5:EC88544988E9C6E6147D5ED34D6A6792
                                        SHA1:7C53FD17F58ECB44FEE4CFAC4D0420D1DF45D6C3
                                        SHA-256:F53007686FBCFABBDA4C4EAADE316641363E3B4A2DA67CD445A231BA44C70D28
                                        SHA-512:46128BF02E4E757999D4FD3A26C8C47C128EF3E97986F8C69F1862E577D9A46CEFC4C40A505A364AAF4D540D8230F56A00E256443DEDDCAE03FD01D1974DD110
                                        Malicious:false
                                        Preview:.PNG........IHDR..............N0*....iCCPICC profile..(.}.=H.@.._.E+.v.q.P.,._8J..`...Zu0....4$)...k........... ......"%./).......=...B..T30...e..11.[.._.@....%f..b.....>..Ey...?G..7.....nX...3...y.8.J.B|N<f...........3.F&5O.&...,w0+.*..qDQ5....+..8...k..0..V.\.9.8..@."d.PF....j..H.~..?.....U.#...P!9~.?..Y..p.B1...?F..].Y...c.n...g.Jk...`...z[.......u[.....`.I....4.B.x?.o....@..[k...@..Z......"e.{.;...gZ...JOr.........bKGD..............pHYs.........B(.x....tIME.........?.. .IDATx..w`....3..f........PL3.%.SlJ.D...y.B.BH...f.$...@.[....lI.)../..B.S........+iv.*...V.y..mS.{.o.s...0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\android_electrum_icon_legacy.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):13047
                                        Entropy (8bit):7.960630338437363
                                        Encrypted:false
                                        SSDEEP:384:PmQb6xaK2/Npfno80h2yUGnnj393G6zT4o:PBJX/Tf90hvUGnj393VzTl
                                        MD5:84B454208A0EFB0F9A3C1DDCB0E12A35
                                        SHA1:766685D6287CB52A3679DB3FDE27BE192DBB5FCB
                                        SHA-256:38DE29E991C770720C609AE6CF4418CD59C8EC6D20A364738806896C79C99A21
                                        SHA-512:E8679AD177DA85310FC759369E00236C2686A030C17094B93B405B66296847FC1DE36A8CA5A50A1E5F9873B44478D4ED5ED1DC789DCE796714C9B61FD1C1B67E
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....iCCPICC profile..(.}.=H.@.._.E+.v.q.P.,._8J..`...Zu0....4$)...k........... ......"%./).......=...B..T30...e..11.[.._.@....%f..b.....>..Ey...?G..7.....nX...3...y.8.J.B|N<f...........3.F&5O.&...,w0+.*..qDQ5....+..8...k..0..V.\.9.8..@."d.PF....j..H.~..?.....U.#...P!9~.?..Y..p.B1...?F..].Y...c.n...g.Jk...`...z[.......u[.....`.I....4.B.x?.o....@..[k...@..Z......"e.{.;...gZ...JOr.........bKGD..............pHYs.........B(.x....tIME..... ....... .IDATx..w..U.......=...K....R ".U..+....*"W. JGl.U.].^+.U.....!!.$..M..}w.s~.....3.;3.....l.gg.s.....{.E......).`.......,X..`.".....,X..`..E...,.X.`.......,X..`.".....,X..`..E...,.X.`.......,X..`.".....,X..`..E................ 4.CO.4m.@.0...P6.....`......:.X.x....&..F...../.{A..%........-.yv..Na5L\.e.!...K...D.........P..j.._..J..o....`.0.|..O.2..u.Z.'7.....}.......P8..........?..:....*.........d.8.g....7G;...f^.#.gT.._.B.^..;h.b.`.b....2..e...=......^..g.^.S....9..n8.<.x."....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bitbox02.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1622
                                        Entropy (8bit):7.798153879675446
                                        Encrypted:false
                                        SSDEEP:48:wtv8Yupelq7Hx+iEOQmcYAUp6Dcvtidb9b2:wtEYJq7H1EbfYAxmMU
                                        MD5:88C67545CEE57297FB2ECB848EE28A0C
                                        SHA1:2B69CD4AF96A93B85B2CDC4589D27AC8DE6FECF1
                                        SHA-256:4F03939FCACEBBC2D33C82436E7B204C8C4A84E51B0E7AF1D1731837B13BB827
                                        SHA-512:7205B254116DB1493A04E50974B70E1F8017B2C6ACF96280FEA6F92D4041B69B7F2CD1DCECC11BB903E995041A11024805D79285B6B2E85730C9926E827DD831
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...k.G..G......98.*.r.r.......`.-..........s...]..>&H..RH.P..B"..tHA...C`...]!.f.3...$........g.{..1#####.Y.eYq*.*-*5*.CE.\.J.J...`..%1....%'.-.J...E..T...]t....Uu....Uc..d.7.V.V.5|x.V..]i.mM}.TqS.).JV2..p*`...d.x<n...!....t.I)3!...08.)^.....r..<T.).h....- ....N..J.r7...h... ..../..^qr......0......p...@...4...@...4...@...4...@......5......tI?.&...2X.R7..Z..~.Q.Po.W..pu...qS{...*..N.`.9.$.....m7.H.p{,]...D......{...d..o.2J.Lm...mG.....7..0.Zt.t...K..;.... n:N...=~..8.....A...0t.s}}=.#...K-......gF....._....z,..4...h....S".F....C.y<U...........(....O..b..-..u"H...;...*.j.SA.(D.@..L9....S.S.z.}./2..0.1.n.xD.....`..!@.......#V..o.;.,<.{.e/Z...Mv.......O...5.._...yMq..M..X>...EH5.{.d.ruu....9.j.*<...9.....k6?... w.....!....#.D.k!7....w||..,[YYa.D......m....u..o....=.......3...#...y/...J%. 4L.....q.ZZZ...].@..P...._.D[.<.s.<.....8.... ,...p.c..8.....C.{.P...8.r.......{.}..=.x....W.Z

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bitbox02_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1629
                                        Entropy (8bit):7.834581298925457
                                        Encrypted:false
                                        SSDEEP:48:3K0Ht2XF2vs/qLLvlhUpMX3FFlXSVB8QVM/kM7DyR+:TLvs/qlhUpMHtXSDukM7L
                                        MD5:8259D1CC28BFE5ADB3F3F3EDBDE387A6
                                        SHA1:53C5BD011D29674CBF48A88A27AB55E137A31099
                                        SHA-256:E7E0D0669C13930D9460F570CAF1627ECC41001F3E09E001CC1BB33DF589D9B5
                                        SHA-512:E6C30802EFC171EFA6E16DC968EE94CE3F9EAB06C41E1EA8EDE6014FB6A233D2B4CEE0CC4E4E84F835CB8F1189CF7C457E3E5FE7C3D3745E0EDE487587869836
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\=L#G..;...&B..@...$..&>.D..H..4.....4.B.\....... ....W.B.d.(bG....B .b..3.2....wfvfY.|.....7.o.]B,,,,,,....F7.9*.*.Tr..1.T....h.....O\..JC. w.Zj.j..,U@[.7.L...T.+..OJ..*....T1.J..8>>nz.V.5....0q..A.....!t.gggdww......299Iz{{/.....988 ...dpp.tuu.\...U*.R...y.2.8sa...@...."D..eG....2.D{....W*..F` ......Uu....s.......9.^.b%...q......X.B.lmm9$......S.0Q..y..H\__.U.....h...Z.-,..@K.%...h...Z.-,....M`..j.m....%...0..............T>I...*pRX....b.8{e......O.x.W....b...3v..p.].Z....y....N..>...J........ .:..U.p....>..&5.....7....4...<777/...h0g.af*.a.7pMXT~v,h....S.*....=55u.iL.LU..c....@.o__.o0a..@.q..........}<....-n.....M.L..}U.C....l...Kl..K...E..1..R&.g.Y...vk.H.X.6>.~(..Vb...O.T....g".&..y...o......_....j.T.W.. ..............Jl.........'.?>%g..%.....C.w?.L.M^.51V..a.8Q_.T.d.......D~..?/.=&.?.Al.(...<I...........D@.4N.Ly...w....h..._;&+...>...9...(.#F..Yp..."....A\._.ibL,..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bitcoin.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):8928
                                        Entropy (8bit):7.948051857397655
                                        Encrypted:false
                                        SSDEEP:192:dS8r6wty6g+DOXzBx4nuCy4aYHTgo/lZD4TuxS0gCfpzgUwpR3cNFAYuisr:c82wtGXtKOouuNfhApa8YNsr
                                        MD5:E2258D34BC7FBA986F19971C17B47D6E
                                        SHA1:109354F506805E780F9CBC349185F060EFC9E8CE
                                        SHA-256:E7F66AFD718A21082807DD948CC6E9B06D0CF3BD3181B2A92574E39A3AE4724F
                                        SHA-512:3D355087020939EF9DF370FA531DDA4933319E1BC750F899FB47AB2C7C6A2FC64CEA0E8A8DB711BB811069A387455F37D0F7529516B1DD749445DC281372EC7B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............>U.....bKGD..............pHYs.................tIME............. .IDATx..y....?ou...0.(.FE....Yq.WC..Q._.r..11h q$.J".,....!.....Bv.Y.f\.........L..LwW.?.}X.....|...Q......9.wQ..[F..k.6Bq.........b9.:..^....l.H....?.....Q.Ay..pl../e..8......pCT:...4..!.[...d)~.#.-.x3J.L.....`.b.....H......^m..K....g%.q..b..X.cI..`...b....H@..%M.Iz-......M($(.....x....j.S..J.._...+......).Y..pE!.96.d%...d.X.....p.U..P.W.O...=......'_/.G......7.U.S.X..U.9.G]{.`I.E.V...hj.M.v...+:....nY(.X..H...,....X..G.g.^Q...7.QW$.G(...H .P..^.@.....".8B..xE.B....#.`.l/..#.`.."I.#.`.W$.G(...H .P..^.@.4.W$..G..).X..I$....^.@.....".8B..xE.q..,....W.z..]Q.)4>....2...-.,.#.,...O+..*....M...G..{.z.6......A..V.....x.Cu...~..`O.C.......x....T.}m7..6..9Um.Y..J....+.7:T?s3...g.^t.....Wh..&...eE[1.s......x....^.uW..3.....?.b.b...X.x#_.d.....>..9.7.s.V.....M..uc.]...iT.(G....v.|...YM.kS....+....8...L.yS..g..ny....y......ua...|...ua..M..`..@w...h.b.....k.6.Y.".`I.-.8)

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bookmark.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):455
                                        Entropy (8bit):7.042424747937357
                                        Encrypted:false
                                        SSDEEP:12:6v/78/6T/sv7SXmUKQrDUVrDUVrDUUERfexqsLh3:p/6YBUWiiPRmssLh3
                                        MD5:AC44F72D2C7A988BD98D8B803C17269E
                                        SHA1:5BA8D489497C5B9015154C4812C553424E7A8120
                                        SHA-256:DEA30755C1B6F31D91A5A9029EDDD1982B097ACF8A8B1406C8E236A64574A34D
                                        SHA-512:D39A3D7585A4B81165E3925B84EE5A2222C8BF9F3ABB1AD618ED09038A1BB297B6C2FC8C031E45A19F9943F605BBD3B443221764D702DB034D526CF3420BDEF1
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs................yIDATx...Aj.@.....PH.z.Aob.9P7]........p9%A...6q.....w../..T....NM.K....2@X.......,....;.....X ......&...5.@.....hM,.@kb..Z....X ......&...5.@.....hM,.@kb..Z....X ......&...5.@.....hM,.@kb..Z...p...]7^<....w.n..z=^....|nL....h_.0..Z...&.......W.O..i.w....X`.....$.,.0L...d......E...p. ...7...2k...ps!...F.........>.=....}....Y......P..M]d~.u.p.A..S.r..... "......7...>....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bookmark.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):588
                                        Entropy (8bit):5.488645888225472
                                        Encrypted:false
                                        SSDEEP:12:TMHdoIdSNi/nzVA3/KYf3naXiGEKZx1OpGmDZC98zWHomPQS+2:2dVUNA23Lf3ElEqx1OomDZ/mP7j
                                        MD5:9FBFBD6864433EA664DBE4512FF9A9A6
                                        SHA1:5920AAB616C75E40038E626B0548C529BC55C947
                                        SHA-256:347637DA15F56C9B1B3A925087215F68904DA35768EEA10D8D000A6C53E1D205
                                        SHA-512:B4E356201F14B3597F2FEE5205176A63A572449DDD44C258E360BA339B8D3F5A0D3A4502A56FCDAD951AF38C168E8C72238F087B87C53B01D40BCD9852538B86
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 19.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 40 40" style="enable-background:new 0 0 40 40;" xml:space="preserve">.<g>..<polygon style="fill:#F78F8F;" points="20,31.441 8.5,37.191 8.5,2.5 31.5,2.5 31.5,37.191 ."/>..<g>...<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..</g>.</g>.</svg>

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bookmark_add.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1364
                                        Entropy (8bit):7.779704024875446
                                        Encrypted:false
                                        SSDEEP:24:p/6hKcTqJ9+QI3+RXnhvk+6Sjey06Rt6hrXD3zJFxftJ0PaUpkc:p/6hnHR+tntknSj06RtSrzFJJma8
                                        MD5:B489310986A6828F9B9D62131D98FC52
                                        SHA1:567737353B9C823D2909E44456AFAB161C52D3DF
                                        SHA-256:F58B07469ADCBDAFEF16797C66533E90F94F12B94E96E9C2AA1926BD2A1881E8
                                        SHA-512:93053CD022CAF74180E0B0CC4F1FEA0C718157AEFE371DB57F376932ED2C547DD93F2E1BF46FAF7452A8BF72A400AEF6DAE9215C15D40A4C919EEC32F6565220
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs.................IDATx...O.V.......M.7&M.....h.....N*....a..PS.t......ZUM;.R(......RU...o.i..z.sc'.k.8q.....H..?>|..a...q..[.....N.W....'....s....\.>..|..m..D8@..q.r.TM.........m...N.L/...p,...+..F.I...@;...nP.'.....v.....K.|.9.=.(.T..KA%.Q...Wv%.;.>..@..uA.U.......+0.h.f.....{.......2v..R.WCj.....R......d.N...<.m.,..Kg.m.x.."......i.[.~.f...n...[2\[.+..vGuJ.*9....G...I.[.~.......J.bp.}b9...:...5..Q..ak).._..N;...+........z..l.y..Z.+.h)1.....K..<P.h....nv..&...1.P..B.....5U..]ZP,.>p,O.(..$.JU.....]....qr..U..Y.=f..y........M...L..<u.Pa.I.....?...">m.?}.9.3... .g....D.M%..&....p~.....@.6.cE.g.`..O..1@...J...0....y8S..j.y..k..(l1..E.wI0...p..yk'~...6..x.K|.....P.{..U8.n"=.....D..T.....Rn..9h..r.c.7..h.4.p.D...R..G...%y.....h..b.b.....U...da......4..!E..tC....W..~.H'./_..~...;...PI)...d.S.Z._^....C.A.g..$.J.....<|.s+t...X.$.._..(L.....r.Ty.>..u....Z.cf...)....[S.n.~.l.M#...<.j.Q..j..E.n`.fg

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bookmark_add.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):1082
                                        Entropy (8bit):5.469015753372596
                                        Encrypted:false
                                        SSDEEP:24:2dVuAPLPqEfvzPoPDhUP4omDZ/mP7Wo5hyo6pe7vlYU+YsGQ2wUjURxN:cVuAjPmPDW/m1e5hJ62cYsGvwec
                                        MD5:F273A1CC480055181AC96A7B5CFAA99A
                                        SHA1:71BF75F44063C34873556ABC152C20E9FFB947B1
                                        SHA-256:08145AC69FA8B8142FD72954944EEFA873C4F457CE4335898AA66BA6C1E1BF48
                                        SHA-512:EAEBA74E36CD877FD299CF81115B9AB56B2CA521CBBEA62D53CED056AEB2E3CAE1BD5CAD9986A3D3D8BF42B58CC5ED6C3B080B6629C9FE8E3E563382B9B43A7B
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 40 40" xml:space="preserve">.<g id="Layer_10">.</g>.<g id="fluent_1_">.</g>.<g id="color">.</g>.<g id="office">..<path style="fill:#F78F8F;" d="M20,31.441l-11.5,5.75V2.5h23v34.691L20,31.441z"/>..<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..<path style="fill:#BAE0BD;" d="M31,26.5c-4.687,0-8.5-3.813-8.5-8.5s3.813-8.5,8.5-8.5s8.5,3.813,8.5,8.5S35.687,26.5,31,26.5z"/>..<path style="fill:#5E9C76;" d="M31,10c4.411,0,8,3.589,8,8s-3.589,8-8,8s-8-3.589-8-8S26.589,10,31,10 M31,9c-4.971,0-9,4.029-9,9...s4.029,9,9,9s9-4.029,9-9S35.971,9,31,9L31,9z"/>..<polygon style="fill:#FFFFFF;" points="32,23 30,23 30,19 26,19 26,17 30,17 30,13 32,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bookmark_remove.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1352
                                        Entropy (8bit):7.765380971209657
                                        Encrypted:false
                                        SSDEEP:24:p/6qrMGofunXbdmyDEW3qM8S0SmgC+K3FVaDzSjOAhb0Av0:p/6qruGnIwEW3qqCH3faDzSjvpN0
                                        MD5:32B1AF7331614E239777D9E89F2A8202
                                        SHA1:36F63C393E9540982A4DA4A9764A1662FD9F7BA1
                                        SHA-256:2A741F72CCE7FBFA3F4017CC79729EA21E4066F963645D0C669D21AC79251D4A
                                        SHA-512:31BB88F613B21CE55C26A72AF2D7D5BDB0A6A723ADEFA2BE9F77B0A0FD54C16FD63EFA7BEF050297CA23D8AE2B2DA85B1EE2126DC67994AC620631E43416E207
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs.................IDATx...k[e......^....i..7...7.dMo.5...U:..&.za......X0mt..:.du._.......s./.....v.<.7..m&.<..}...i~<....{...#L.0a.mZW........ .....\..... ".#....M......4... S.D...LM...n..T.V.b..?....0....H....fC.d...9E..S.p6...R\...:......;...-y6,}...-....J..'F.x....G.A5......VJ.q.<<.f....R.....#...)..*.7v..{g'.:r..`a.......i....r|...(..oo.T...`.EW..;.$../xv..~.:..+SM.......a.Y&..?.._v%...I(....v.6.R....7.S.i...n.D.!@.V.N....9j.,./.D>..w.....U3.a.......9E.r..?......Ku.>k;7rb.$q..:.*x`.....OXQx..N...D.lI.......J.....+...r..Ya....<....S.....R.F..H....s..CY.8?..U....."..<.4<.+.}.6.q.p9~.,..WV....m<....)..1.. .z.,......~...W.<..i...........,D.d.()X......>..w..y..Uq....e'..T.VHW......~.t.K.H.])W...h....u...@..L....fBV.....+.kg.."pz...N.C....sd.H.=.6T'..Z.....S..O..r........../..._........<.C..#....|p...x..s...|.C.4......`..X....Xs..kJ.j.il..c..YJR.wgq.>.9....UxN.hA..6..pz..nM......0.hD.ko.0l.y..D....fkej."..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bookmark_remove.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):1032
                                        Entropy (8bit):5.50128040726307
                                        Encrypted:false
                                        SSDEEP:24:2dVuAPLPqEfvzPoPDhUP4omDZ/mP7WoihyoY7vlYU+YsjW2xN:cVuAjPmPDW/m1eihJGcYsjR
                                        MD5:81CCA7B403F86BB43C974B81CCF04E17
                                        SHA1:366177CC215334772D3EC9A4D0874201A168EAA9
                                        SHA-256:0ECBC4A4F205C098C33C22FB3C66BB99D93B3E47FE06D03FB191234816B9B267
                                        SHA-512:AFB81C0C6639AB502B128AF4528D9F4E80F8C7ABD82E99CEFF6959B79092E8013C8C66B04433FFEBE83745443AA68D8C695B912B80EB02ED05BF64532E877983
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 40 40" xml:space="preserve">.<g id="Layer_10">.</g>.<g id="fluent_1_">.</g>.<g id="color">.</g>.<g id="office">..<path style="fill:#F78F8F;" d="M20,31.441l-11.5,5.75V2.5h23v34.691L20,31.441z"/>..<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..<path style="fill:#FFC49C;" d="M31,26.5c-4.687,0-8.5-3.813-8.5-8.5s3.813-8.5,8.5-8.5s8.5,3.813,8.5,8.5S35.687,26.5,31,26.5z"/>..<path style="fill:#A16A4A;" d="M31,10c4.411,0,8,3.589,8,8s-3.589,8-8,8s-8-3.589-8-8S26.589,10,31,10 M31,9c-4.971,0-9,4.029-9,9...s4.029,9,9,9s9-4.029,9-9S35.971,9,31,9L31,9z"/>..<rect x="26" y="17" style="fill:#FFFFFF;" width="10" height="2"/>.</g>.<g id="ios">.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\bug.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3075
                                        Entropy (8bit):7.904263151460043
                                        Encrypted:false
                                        SSDEEP:48:W/6N1ubZjol2GL5f+aWj8ikmCxKFy+BSefUupxRmNHxie1XV+f4GQq2YMnz+JEfh:WSMZK31jWpDyupxAxxV+Q7nzXfyU
                                        MD5:58D5B993E5E1A07C5DAD4000C8190628
                                        SHA1:63CF5C244D9FC9AA532512DA0D3011382ABBB372
                                        SHA-256:BBE2B982ABF71264A15B456643A73F165C28077F829E0855BE2CB314CB6344AA
                                        SHA-512:3D0543B944CA107953B00112CA511780F13045D369A2B698445BB4E6B610502908FD437FC387B79BDA43D3D21B369B20C682CFEBFEB457877F32F3796293ECEB
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs.................IDATx..]..]E.>U(V..JQQ...@YT..@ .D.@L..(.H.P..4b.A.......E.(K...E.d.US....Q.RP.........o..gf.{o..KH..o..w.......................3..0Oa^....n....k...\[..#...0/d.c......5(..f.9.s..R..5.s...gQ.)^..f.}...L.=...}.K..s.....U-.aK..T9>u.K\.....#......(.CK..g)s.(..!L...[.F..X].I..j.YGQ5Z..V.).pK'.+vd.F..,..`.d.!.._.jdm..uTM.0.0.2.f..|.s...[...k.7s..,..Xg.k=.4.......e..l..F..7."Z~w'.e.\....<.6.8p............P..K...(..ZC...0...(..N...{).i.G2_.Zx...Z0M...:...&..\8......g.^..3.WPXd.......'..S.....]....B.b..\...7..&.}*0..3.X#.N.ak...f....0a9...OR5...%X. .f...|p..A...W._..G.2......|q..p'@..4...7..;n.....p~.....V[..{...d.&..>.Gf8N ...Vydf.>s?!...cyd...|.T..T...*P.[I..<0.L=.L..^S.k....) $~%.|.`Qg#...6......6....H...v.C.o....Sy.1U......Ic_ .I...7D.7..5L...|..u......j..K...j..........].j.wh..M...K~...3K.hP.z>.z.m..6}~...Y....yq.eZt.X......`F....'....I%..."..]}~...!....Y.N.(.ZI.]..w..h.E_.....4.I..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\camera_dark.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):687
                                        Entropy (8bit):7.514196356494635
                                        Encrypted:false
                                        SSDEEP:12:6v/77KTJvSkHqgbo6pj2iA3+pjOLqWfro1MNzPPIey6eEg1HMtYInhhUdEpRrVx4:uZkfooqiAOEZo16yLEg1NW48RZEN
                                        MD5:87CE8A3CCB880A6EE050C820EDB75068
                                        SHA1:88A3D07B23A5A8CADF3CEE46E78C7EC9A61EF41D
                                        SHA-256:341FD5486720DF63EFEAD45A90EC8A9353CEA9ED09EF5508E073F0428D93A708
                                        SHA-512:C02FC968499B7C47092C6D59FEA7AA4CC812B8A75CECA831D3FC2358043EF95232592AA35E3DA1E3CDEF3D9DA3B4F2EC1613411C9931C2E9C71BF3EA24B153DB
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD..............pHYs................tIME......+t4.....<IDATx..Z].. ..X.g..5.P._.VE..K..N.'..`0...U8.x.3..3s..p....{.....Y.DD!....8b.^.1.^..v.A.{...........=!...w./.#..H......f......Hx.b4..........pG..{f..W}..R..!....wJ.[...nS@.2s......kK..k.....&.....3FDQ;...R...s...r.\..{.!sK.cJ>.H|z_.H.vl....3.yoY...<.=.V...8...R@.X...6s.M.B_.5..g...M.:... r.*..u.=~_..%G/....o...I..s.<;w.1...;..hJU+....&.[+.Wh..0.".w..".......J.*E.db+.1...b..M..fZ..rg.jEP...O...a.YM......@.........@*|JVc.@..c.>.B..J\/D.....A.Cu..J....>...6..,@K..m-Q...z..C...t.RG...r.I.8.N.P.wxt9<.......A......c$#D.."....j...{.vl.......`0......Qr.,........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\camera_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1304
                                        Entropy (8bit):7.73373936021494
                                        Encrypted:false
                                        SSDEEP:24:LKMHZVaoiN+HxWIHcVIFZ5EcOi2xFoJkIB8fQcI70LVHFX1uvXRA2aE8/at33c:LKMrao8IHBrDOrx0lPAJHV1uvBA9E8/r
                                        MD5:EB23A09A738F035E563EF333654A4B31
                                        SHA1:A8964E27694D3FFF799B752EC18C83558118A08E
                                        SHA-256:2454278F24E89C9B8E7602A1422F1E7CE9542A5D6BBFA8550E1F281C0680807F
                                        SHA-512:29DD5EC709D7B0479605C59B53F8D16081BDFD754D75FF5A1CDBD67AB7FDB44E02730975F3ED1907E67EFA3E377D853BDA8594140AEFFBC940B3D4DD5DCBB5EA
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD.......C......pHYs................tIME.....4 .q".....IDATx..K..U...S..3#..(.$.ua0.A$._..n...KEw....Y.ti@0Y...T.3...F.T4Y..1...83.S...S..~..z........S..s/4h.A...!.Up-.d.fV>...G.........x..O.l.(...1.K.7...73..,*.... ..r<$).E..q]d....l...`...[sKR...gQ..t'.*..p....%|...Uv...2...........I...y.3 .....X{...O..y.Y.I. ......w...o.,r.W..^.~GFI.f.H.I..0W3s..\...9....&."..{~...s.D..&.t..s?..|.|.\.........3.K.....a..XB......tZ..x...&).....yI.......Ss... ......C..JZk..._...)..k..f....1......Jz...n....X.j..N...@..t.f...-.v!rm.lQ..X7.nE.1.^6......Jj...P~w=....=.T....^I...m.Kz.......h..z..N.w..........@X.J..8....#.....1l....<.._....y.X.t_.l... ....`g....~...S....;@.s.^...z.Z..g).K...r.u.Tf.S........../y$....GI.w.B...I"....cA....~..x.~..i..j....N....C.A.8kfi.y.....T@.|..L,....o.`1O.<.~^...j.fv..u...T..Q..u..L+E..].3Sp....p gI...S.........h.MtR.%W....z(@..1..xiO...b..Q`...H.gs..1.+cV.Y......O..i...f..1..y.8M

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\chevron-right.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1044
                                        Entropy (8bit):7.628204010871327
                                        Encrypted:false
                                        SSDEEP:24:C/6StB5M1MeKxwTdebhEtSHqyz4hjjhdO8ebivZ3dq:C/6Sb5M2eKxwTdedEgF2QZe1dq
                                        MD5:E1FCB8FA7C8B646F58B7081A9242C813
                                        SHA1:3DFDD33480CFCCCBB61A35DAD17D2977A8EB2651
                                        SHA-256:A714C0CB5D434E4ADCA773815FFF60A37E8204008B698C2CAA805AEAB2E46415
                                        SHA-512:9E0F9650EFC1F85CA7A6741B84406D0148024B4BB5FE0553A13A1DD0B88A064563580D6EBC77EDC372963127FE1B40D24BE11C5597FCB68464A98EDEA32BBE80
                                        Malicious:false
                                        Preview:.PNG........IHDR...`...`......w8....pHYs.................IDATx..M.VU....Y....`..A..4m.....@lb..."...D.......KG:Hkb..@.0D/g........O..8...(....W...$.^.........{.}.q..(..(..(...A.EP$.[CP1.....o...b.ZH.Q.:.A.J.AFp...!...{..$)..?.n<!D!...l!..z0.A.....Q....7.A.'.p.Ag.B.B.w..Qb...SB./..2..{. ..n<.....~B.1.Cn*.\M.`..z..b.z...z?q+...n.!D.e...~..8B.B...!x.D.1.......Cx....!..Z..w...7q.;..b.|.A..@N..B.B......M..!.Pw>"...G..`5...he...2..........Q........B.~...!N...s(^.,y.3..T......l....=....!..K.A...Zv...~..*k....E.C.....<k.........h....3@8h.....u....C.}.^.mk.e.8^..7i.....A...a.....^.......;...V.........'.[{-=..A}..kk..;3....v}.^..q....Z:.}.^K..b.u...N."lX....|/.......=r.e.^.eXtO.QD..0.......g.L..^K.$....J.......{,...2...E..U.|./.m..'...k5c..;.}/7..h!...|A.6\..t.._./..*...F/.5U...{...~.p.W.Y|...^w....>L^. C.W..Vo&.W.....x.r1...e1.....3.....dc....b6.U....x.2...^.qt.i....}..@..3,.{X......VB.}.^n%...Q.L3.m..]..#>AWX{m...f....}.R.....)C.p%..[.(?...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\clock1.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):7607
                                        Entropy (8bit):7.831394572490859
                                        Encrypted:false
                                        SSDEEP:192:DW4dCKlspppp6L6U0IqcE9ep1cX+qXboPgKJztFyuoaFKcKjfS:aWCKcprge9ep6LXMJptFNfMfDS
                                        MD5:EC485EDE1B8D7CC4A86BF8791E4F5D2A
                                        SHA1:620EAFD5B00E551A3986952A27906BCB0119697B
                                        SHA-256:D24A9CBD7BA52FC55FF1234E137258DC1DFABCB10BD5FE08A0D08E3B617DB346
                                        SHA-512:170B63605F75184B5A20405717CC0F8CF8A7E1670EAB3051E2E877B74E7E2B7AA2FFD409812339A85B2DC4DB112A6156DA9D3C150F91F68FAD391CA9A2378F60
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE...................................................................................."..$..)..,.. ..!..".. ..$..'..&..(..*..,..1..7..9..=..! .- .!!!%$#%%%)#"/! )))---0" 2$"6&$0..8(&<+(111633666888===C..D..I..M..Q..V..X..]..A.,C0-E1.J0,G20@>=H30J41L63M74O85Q96S;8V=9X>;a..f..h..j..m..p..u..y..~..B@?Z@<]B>AAAEEEIFEIIILIHNNNRNN_C@QQQTPPVVVYVUYYY^ZZ]]]`D@fHDhJFkLHmMIpOKqPLtRNvTOwTPyUP}XTbbbd``fffhdciiiokjmmmtonpppuuuzuuyyy}}}..............................................[V.\W.^Y.`Z.`[.a\.c^.d^.e`.|{.fa.hb.ic.id.lf.nh.nh.pj.qk.rl.tn.vp.wp.xq.zs.zt.|u.}v..x.........................&..6!............................-..>&.O8.RA._K.eQ.sa..y..{..|..|..~..t.....................................................................................`S/....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\clock2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):8512
                                        Entropy (8bit):7.85639057571749
                                        Encrypted:false
                                        SSDEEP:192:Oswc9zY7L3k9gwwvsQDEfoZeIW8vs7/iIIEKEP+8p:Uc9WLU1wvs9oIBVQEP+8p
                                        MD5:D957119A80CF635B49D20CF56F4E1065
                                        SHA1:A70F47466330F4B39968723B02FD0170CE92E665
                                        SHA-256:FCFCB13DBC166EC8FA671C3D2BDCF365CC8634AA63B94CF69BBB6EEEDE7B0BCD
                                        SHA-512:35285A9855E726C69CEFE80CDB03FD4901A66150989DCF0FADBF51D1EFC904C3EFF2DBB4F657096DB8844AF38D0D3E3E3EDC8DFB43A92711BE8E57153388FB94
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE..................................................................................................."..%..(..+..-..!..#.. ..%..1..4..7..9..<..! .( .*!.,#.-$.!!!&%%/& ))),,,0& 2("5*$7,%8-&;/(=1)111666888===A..E..H..K..M..Q..V .X!.\"._$.B4,E7.F8/G90H90K<2L<3N>4`$.f&.h'.j(.l).p*.u,.y-.~/..0.Q@6SB8TC8VD9XF;YG<ZH<]J>AAAEEEIIINNN_L@QQQUUUYYY]]]`L@fQDhSFjTGkUHmVIoXJpYKrZLu]Nw_Px_Py`Q}cT~dTbbbfffiiimmmpppuuuxxxzzz}}}.0..2..3..4..5..6..8..9..;..<..=..>..?..@..A..B..D..D..F..G..H..fV.hX.iY.l[.m\.o^.p^.r`.r`.tb.vc.vd.xe.yf.{h.}i..k.I..J..L..M..O..P..P..Z..R..S..T..U..V..X..Y..[..\..\..^.._..`..l..x&..l..n..o..f..p..q..r..s..t..v..v..x..x..y..{..|..|..~..8.X..K..c......................................................................O......tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\clock3.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):7229
                                        Entropy (8bit):7.785150298696893
                                        Encrypted:false
                                        SSDEEP:96:1aMFUMGlDs8zLR0tOaJHyzDK2VFHzY4MpeXjxH+NXtKSYANS9jSBDanhBUd:1b2MGlDsGLR0tMDj1CsxIthk/ed
                                        MD5:D98936082F2FE74CEC8ADC729DAE1FB6
                                        SHA1:82B03877AE7E92E88B94359CF02AE6F9D3058C83
                                        SHA-256:8E8EAD8B910B4528A6AC8C4CD8D7604432D7CE51FD166B79FB4A19816866180A
                                        SHA-512:7936AAEEAA21AC5FCDD4C59A23768582B7A272259632921B14FD389A5C68447E11EAEFF009F2D410296B860870D5DC430CA96B4CCB0AE321F3711E55852E7FA6
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE......................................................................................................... .."..%.. .. ..' .)!.,$." .%".'$.(%.*'.+(.,)./,.0'.2).4+.6,.8..<1.!!!&&%)(&)))--,0- 41"11.95%=9(111773665;:7999>=:===B6.E9.H;.I<.L?.A=+M@.PB.RD.VG.\K.D@-AA=JE1MH3NI4PK5QL6TO8VP9XR:ZT<\V=_Y?`O.aP.fT.hV.jX.lY.o\.q].t`.xc.yd.~h.AAAFEAEEEIIGIIIMLINNNTSNQQQUUUZZUYYY^^^a[@g`DibFleHohJdb\piJrkLunNwpO~vSbbbffcfffhhenleiiimmmpngpppttquuuzytyyy}}}.j..l..n..p..t..w..y..{..|..~..yV.}X............................................[..\..^..`..b..e..f..h..i..j..m..p..q..r..t..t..u..w..x..z..z..|..|..}.......................................................................................................................................Z\.....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\clock4.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):7522
                                        Entropy (8bit):7.81127387729523
                                        Encrypted:false
                                        SSDEEP:192:jsw06+k8CmaUTBvA+j8eOf6PxPMkguT6EKp:C/FRFj8uPMk7T6d
                                        MD5:F4FA836357AEF23E14DA4AC2298BA63F
                                        SHA1:1EFBCBEBB328200BFFB856090BFE67C8FE5DA504
                                        SHA-256:3819F45A09E2016EA873216BCB9BCFF4BF581FCF6740B7E2ECF0CD0723BFA628
                                        SHA-512:4EC5EE28988B2A66DE20A6CDF805408C92BCB06421A1AAD91F972B0B3FC6CA582604C97985C463CE29D5DAA7F6D34B9BEDE4FB44FA11C2F9A8B6D800F644EF0C
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE.................................................................................................... .."..$.. . %."(.$*.&,.(/. "."$.$&.&(.)-.(*.*-.,/.)0.,3.-5.19.4<.!!!&&&))),,,.1 03"14"47$58%8;'9<(111666888===7@.9B.:D.<F.>H.;B.=A+@J.BM.DO.EQ.JV.LX.Q^.@D-DH0HL2JN4LP5PT8RX4SX:TY;UZ<W\=Z_?S`.Xf.Zi.\k.]l.`o.aq.dt.hy.k|.m~.AAAEEEIIINNNQQQUUUYYY]]]\a@bgDchEflHhnIjpJouNpvNrxPtzQv|Rx~Tbbbfffiiimmmpppuuuyyy}}}n..q..r..t..v..x..z..~..z.V|.W~.X..................................................Z..[..\..\..^.._..`..b..c..d..f..i..j..l..n..p..r..s..t..u..v..x..y..z..{..|..}..~............................................................................................#..F..^............................................................................u'E1....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\clock5.pdn

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Paint.NET image data
                                        Category:dropped
                                        Size (bytes):40479
                                        Entropy (8bit):7.479786333974441
                                        Encrypted:false
                                        SSDEEP:768:pPjUB/mEJUGImzqgyKHjVvrJYG04NBmZaIgnFk2SHM3cAwA54KH3333DOd:+XpFzqgDVvrPXmzN/IcDwE
                                        MD5:936FBAC7C0125C83CE95F6771890DCED
                                        SHA1:2FB70236A591EBA04C4A13CCF18886BD3BD94468
                                        SHA-256:E7D7FBFFCA2E88099B3F92093137742F382D902FF5382940193CC0C8FF0A8729
                                        SHA-512:43D1C95397B230601A8166964232025ACCD2935F24607EA1E92F447A68C1DB39F622E567D72F633154A9ECC5487E0DCFB0AD88429A399312958722D65C2C8566
                                        Malicious:false
                                        Preview:PDN3.:.<pdnImage width="256" height="256" layers="8" savedWithVersion="4.100.6822.38824"><custom><thumb png="iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACshSURBVHhe7Z0J3E1V98c3HvM8kyHzFJEUld4KlYSQf2VooEmaEA1UvIZIiMxD4UmhwVBSSmVqIDJPSRJvRKI019v6r9899/He5551p+e5wzn3rt/n8/3Up845z9377L3P3muvtbZRqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVJFoJxMHqYAU4Qpy9RnWjFdmX7MSOY5ZjrzArOAWcIs9v7788w0ZgIzgunD4N6WTD2mNINn52dyM/ibKpUqAcrF1GG6MMOYdGYls5M5wfzDUJT5L3OM2cq8w8xhhjI3MtWZHIxKpYqy8jHNmPuYmcx65mdG6qSJ5CSzhpnE3MWcz+RlVCpVBML0vQ0zhPmQ+ZWJxRc91uA3/8K8zwxksBwpzqhUKh/hC4+v5f0MvqDo8JhuS53KzfzNYObyNnM7cy6jMwRVSqow05QZxRxifmOkTpOsYHaAge4gM5xpzMC4qFIlrdDA0dDHMV8xsev0OQzlyZtGhYvkp1Kli1CFSiWpWo1yVLtuBapzTkWq16AyNWhUhRo2rkrnNDZUt5GhWvUN1TzHULU6hipXN1SuoqESpQ0VKoJnCX8jumAw2Ms8yWDHATsaKpXrBcs4ts96MpsYNHSpA0RMzlw5PR28bPliVKvOWdSmfRPq83B7mjq7N61YO5Q+2foMfb53PO38ejLtPzqDDp+aQ0d/Tqfjv82j739

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\clock5.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):10074
                                        Entropy (8bit):7.879043925395544
                                        Encrypted:false
                                        SSDEEP:192:y7rsWYYYYWyAdow9w527mWGZiFXqlmIRJRFJwOZHTrra2pow7E5+20CSwAO49nYh:udYYYYhAdXw527fGZY6FRl1+GX7UJ0Pk
                                        MD5:A4B58F558D7EC991FA56D9198695295C
                                        SHA1:2A27A86928564014E22038FF5286FD5D3C7803C2
                                        SHA-256:E59B42DABAB1D50CCB440460BF4847C28DE23249F5B6901FD7DA26A4CF51EAA4
                                        SHA-512:4473CFD4E32C840523DA30E5CDB466E85A5E703BEEB29A2B1BF406173A5ED5220E4D2CA3D5F24678BD79B2DEE37CCDF9FDFA671C0D34A798617D4963E0E3CEA0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE......................................................................................................................"..%..#..'..&..!..%..)..)..,..)..(..!..#..$..0..1..5..8..2..:..9..<. (.!*.#,.$-.!!!&&&(((***,,,&0 (2!)4",7$-9&111666888===.B..C..E..I..L.!K. M."L.!Q.#P.#U.$W.$Y.&].3@*6D-9H0=L2>N4'`.(a.*f.+h.,j.,m..q.0u.1y.3|.4~.7z.@P5CT8DU8FX:I[<I\=L_?@@@BBBEEEIIIMMMNNNPPPRRRUUUVVVYYY\\\^^^NbAPdBTiFXnIZpJ^vNayPe~T```bbbdddfffiiilllnnnpppuuuxxxzzz|||~~~5..6..8..8..:..;..<..=..?..@..A..B..D..F..G..H..I..J..L..L..N..]..i.Wk.Yl.Zn.[n.\q.^w.cx.d{.f|.g..iO..P..Q..S..T..V..X..Y..[..\..]..^..`..`..b..c..d..e..g..h..i..t..~.#..l..n..p..q..r..t..t..u..z..z..{..|..}..~..5..F..]..q...................................................................;....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\closebutton.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 43, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3521
                                        Entropy (8bit):7.9323910528379065
                                        Encrypted:false
                                        SSDEEP:96:S6MC1mfxQGFRS5VXbT/yeTaDLrDhSU8vK5:SaomgRSfbTdefrdZS6
                                        MD5:07EEB16ED0040531D2568CF359468D91
                                        SHA1:69BA21DE53159D068389A698D9BEEAEE8FA87D2F
                                        SHA-256:0E6FC1B67FCFEA30ADE09EFEC461E9CE1A3A2EF99683FB83BC3B2D2A9442B50B
                                        SHA-512:1975BF10DAAFAAB18430359C0C301AAB274A4E7D20605A7BA6FAA83AC2B2185E336EB78B421A6DA9700D19661072028EC1973CB6E7685C4A04D881FF609125B7
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...+.....$/.Q...AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\cloud_no.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):14573
                                        Entropy (8bit):7.920266929168651
                                        Encrypted:false
                                        SSDEEP:384:UiH7JdrGAPcFuLFpNQ/PfN7Tr/SLNdfc9GOVXyTO:PHddr1JFpNkHJTrq5ux8TO
                                        MD5:91A7EC74C96AB0C177AD6775BDF07E93
                                        SHA1:72E6C153AA571AA7DEABDB2CD52E46C98CEAFFAE
                                        SHA-256:9FBFCF114A0AE26F486AA31D1647F21F291760C322A3805037D48FC6B904A388
                                        SHA-512:D367A3AE76ADC3304643F687930325D15EC40905405219270CD14E516476F1FE612549055354F3E4587B3A19C51F8B108AB11D8940F493B8A74665128B11FC4B
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...X......l.@....bKGD............ .IDATx..y.\U....Vw'......HB6....2.#.2/...a.@......Pv.@6!..1..:...2. 8. `......tw.......v-w9.{o.{.>..G?.....r.N..U.0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0... .....?<...?...3.O.y...Q.a........{. ..@..M..E.?MZ..-Q.a.....v..CN.9z..5ew.5......7E21.a..D*X....d..I,..VA.&,Y.a.I$.. W..,.0......K.a.DQQ.....K.a..P1.. W..,.0.."..P.&,Y.ab..v..3.9. Z..\.`n&C.?.....d....PW..\......d...-..`.m.....s3.......{0..h........d...w....Y..c.........`k2..P1....?.=..J.a.8.....u.R.)K.a.X..`.3.O..?.Q...,.0.!.....<h.0.<....z..W.0..9.^..e.&..I..,.0i."..e.2..F*.e/,Y.a.FE...%.0L....n.d..I...d.K.a.4....d...v"..n.,.0.L...X...T/...`.2.S..B..K..9x%5..o..S.....AP3...9j....:A.....lN..... ...r9.>....6!..Bv.P.9W.-{Oi...c.p..O.q"6..X.I$/.]..24O..'.....`&..A. ..b;..fAx...%rx..x..[..V.~..`...J..K6.....s....a.>..C.0..L.........!.K..7........!..;..,..e.MCc.@.. ...8......@...f....Ea..o...N.Y.4.(.K..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\cloud_yes.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):8329
                                        Entropy (8bit):7.763067899763679
                                        Encrypted:false
                                        SSDEEP:192:HS9co0ZDo46eSNj0IzZMF5InvbJeZhZpCc2gBUBPb+YbUFsb8:yuozeSNQ0ZMAjJeZhTCHgeYYbY
                                        MD5:8477160CC0DE301D338DF75CA1F09CE7
                                        SHA1:F8DB6074FF1A4B8FDFE687DA6579E1570C4CB6D2
                                        SHA-256:E6E57571718E100EC906099C2FDEE135A25A5B7D4AD7B263D848C26C55E6D456
                                        SHA-512:EBF44772AD1D8EDDC3699339E97FA32DE998B0FBBEAE6CC81EF93521BCFD8EC8FB76B9D61FB29BFB304B02B3C98CBB4BAF96CDC626F4CD7652DF9426B15C67E1
                                        Malicious:false
                                        Preview:.PNG........IHDR...X...X......l.@....pHYs............... .IDATx..o..y._...^.)..I...*u......E.8m.]l.4q....h.m.8.$...[$E."e......m.I.x.m..&u.4.l..i..CR.x.o...Y.C..I.......x..................................................................................................................................................V..]....`QaS....g.......c....Bg.eks..Y..o.6..,t.......i....)...4..U..h-l.7.6.j.......V...t^..#V.v>Y.^..$..N.V....B.ls...\.V.3.9..:..Na.|.x..4.F...&...1......._.7.?aqz......`i2m.....z.6.@.._..;6W(ls.'f9R..X.0y..P^.........39.o6....P~.....|...UZ...Y].[....y..._p..}.y....k.}-.).5..?7..)E...\..VW....*.X.....Bcq.F-.....s{.n.....V...^ou.x...9.....B.S.y...w.......=hi.>...,...:[.ONH...]\.+...r.T.S.{p~nq..._?..?3....3PX..:\...Z.T.-.jb.....x..:|?.8.......g.`r.k..l-7.....AQ.R..Xg.u.........................%.gf.><...X.6...[9..g...?..:...6.>X.....%xKV.._.r.uB....NLN..'..-.m....w..Q..y...Pk.+xO......c..r..rD..8VW...w.....r..X.....;.......'...l..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\coldcard.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5283
                                        Entropy (8bit):7.742906001757597
                                        Encrypted:false
                                        SSDEEP:96:jknmWIC4/VHmbJX/D6AWaSaBv3LItxj3gBgvEm5DmFR:jkn6YJmAMaBv38zj1vEXR
                                        MD5:B999C41086083E5F35D8464CB88384FF
                                        SHA1:3F0CBE3D67A92081CB81DCDA546898743B5A48C9
                                        SHA-256:E2935A7BBFA30974E65D79394BD3D01EECD741951EB3185A1F4CE9BABE62716C
                                        SHA-512:4AC7B5CF61ADC065521E9D0F9CD0BA34B6D8B231433B79D83963262679E3C81E922A81831CEB9D9930E9A73487E9EA34EB8A681AA93A29A47D2A6CE58A98F1B0
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2022-03-11T10:05:35-05:00" xmp:ModifyDate="2022-03-11T10:12:17-05:00" xmp:MetadataDate="2022-03-11T10:12:17-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9179abb6-f3c0-4893-b300-e3eec0c120c6" xmpMM:DocumentID="xmp.did:9179abb6-f3c0-4893-b300-e3eec0c120c6" xmpMM:Origin

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\coldcard.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):2652
                                        Entropy (8bit):4.974927453525817
                                        Encrypted:false
                                        SSDEEP:48:020lSdlkdlEYvYdWQYoNEXWhjuX7qgN/4QSwhj8hzhZo7tJZJN:isdlkdl6WSjJ0qgNr3N
                                        MD5:4CD7B06B074D75A052B128B1EAE6AE35
                                        SHA1:B817362DCA6C89ECD8C9601C90B95CB8740633B2
                                        SHA-256:7473EB6E4C90EDC6B9D3FA5D15C6D7B4CE65268C5C7838E5BA6E16A1CE981171
                                        SHA-512:CD3A3E01FA538ACE4EE3647FB37AFEE63D4F3DFBE91C67B0CDADE55E8DC47FBB731F6345662406736825E32295D95BE784268FFF07A7EEF1A4A953A55FA2D13C
                                        Malicious:false
                                        Preview:<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80"><defs><style>.cls-1,.cls-2{fill:#fff;}.cls-2,.cls-3{fill-rule:evenodd;}.cls-4{fill:#ff0032;}.cls-5{fill:#00d30d;}</style></defs><path d="M16.66,78.7a4.28,4.28,0,0,1-4.28-4.28V5.64a4.28,4.28,0,0,1,4.28-4.28H54a4.29,4.29,0,0,1,4.29,4.28V74.42A4.29,4.29,0,0,1,54,78.7Z"/><path class="cls-1" d="M54,1.36a4.29,4.29,0,0,1,4.29,4.28V74.42A4.29,4.29,0,0,1,54,78.7H16.66a4.28,4.28,0,0,1-4.28-4.28V5.64a4.28,4.28,0,0,1,4.28-4.28H54m0-.89H16.66a5.18,5.18,0,0,0-5.17,5.17V74.42a5.18,5.18,0,0,0,5.17,5.18H54a5.18,5.18,0,0,0,5.18-5.18V5.64A5.18,5.18,0,0,0,54,.47Z"/><path class="cls-1" d="M54,0H16.66a5.62,5.62,0,0,0-5.61,5.61V74.39A5.61,5.61,0,0,0,16.66,80H54a5.61,5.61,0,0,0,5.61-5.61V5.64A5.63,5.63,0,0,0,54,0ZM16.66,2.72H54v0a2.93,2.93,0,0,1,2.93,2.92V74.39A2.93,2.93,0,0,1,54,77.31H16.66a2.92,2.92,0,0,1-2.92-2.92V5.64A2.92,2.92,0,0,1,16.66,2.72Z"/><rect class="cls-1" x="16.89" y="7.91" width="36.84" height="66.51"

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\coldcard_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5242
                                        Entropy (8bit):7.753235998143419
                                        Encrypted:false
                                        SSDEEP:96:jknmWICZ/ODmFEHmGGdyw0uvnSX2PNdbKYLSoDOBmhDZJ0KobbT:jknuZ2yqaX6Gg20Dj0NbbT
                                        MD5:6A45E384D7D681397143F4F3FC978EB0
                                        SHA1:AE66424F180643900EA63948A6CC554D24D877AF
                                        SHA-256:2BC126C7DBBE256D45E5890DCE1FE9F2C98E2F29520DE8296ED06299497BA408
                                        SHA-512:211D7A8E354B9A1A75CFE01BC795B838E6F019FB5702AEE00DF280DC4669F0341309BD4C031D06303EC29A641F2BDFD36C4881EC489ED88FCE8F53AAB74D40EE
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2022-03-11T10:05:54-05:00" xmp:ModifyDate="2022-03-11T10:12:28-05:00" xmp:MetadataDate="2022-03-11T10:12:28-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:f317a6c8-5482-4a1c-8b72-7d8f79a2414a" xmpMM:DocumentID="xmp.did:f317a6c8-5482-4a1c-8b72-7d8f79a2414a" xmpMM:Origin

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\coldcard_unpaired.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):3566
                                        Entropy (8bit):5.208716809158055
                                        Encrypted:false
                                        SSDEEP:48:cDAvf3HJK5Cx15vbZQ/xp8T5XtmE3XXjLlkoqhL0QjpBeuY8d+3uJfR2:nvfd3ZQ/xSOayoqhoQf9td+3GfR2
                                        MD5:3D1871F9FD1BF9D1F5994F76F0DDA54C
                                        SHA1:1944054008D8C6F9F17C17E72EA41383F403904B
                                        SHA-256:6C189E6791B02AE1029D274024EAA087126D97989B2BAC3FF095A121A715B55B
                                        SHA-512:8DCF4B94C25E6AA3DA1C9CADD8860D26B4F3B2F6D3DA68D0352D91278C05B6F4F87D7EDEA8C7CF2FA9D87AC8387F6F33C2DFA8D94F2051A483739036B10EEE7E
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 24.3.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 80 80" enable-background="new 0 0 80 80" xml:space="preserve">.<g>..<g>...<g>....<path d="M16.66,78.7c-2.36,0-4.28-1.92-4.28-4.28V5.64c0-2.36,1.92-4.28,4.28-4.28h37.3c2.36,0,4.28,1.92,4.28,4.28v68.78.....c0,2.36-1.92,4.28-4.28,4.28H16.66z"/>....<path fill="#FFFFFF" d="M53.96,1.36c2.36,0,4.28,1.92,4.28,4.28v68.78c0,2.36-1.92,4.28-4.28,4.28h-37.3.....c-2.36,0-4.28-1.92-4.28-4.28V5.64c0-2.36,1.92-4.28,4.28-4.28H53.96 M53.96,0.47h-37.3c-2.85,0-5.17,2.32-5.17,5.17v68.78.....c0,2.85,2.32,5.17,5.17,5.17h37.3c2.85,0,5.17-2.32,5.17-5.17V5.64C59.14,2.79,56.82,0.47,53.96,0.47L53.96,0.47z"/>...</g>...<path fill="#FFFFFF" d="M53.96,0h-37.3c-3.09,0-5.61,2.52-5.61,5.61v68.78c0,3.09,2.52,5.61,5.61,5.61h37.3....c3.09,0,5.61-2.51,5.6

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\confirmed.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):54212
                                        Entropy (8bit):7.970233760777671
                                        Encrypted:false
                                        SSDEEP:1536:rGahqm2/VbUguDy6As9ShagaUydNCgTNPJAva3gc:rjMf/VmDnAsUkgaFZhv3l
                                        MD5:8C98780B65103F87BA4F098B7899C4D8
                                        SHA1:3F4D4499D9AD2EF94FB50BAA5EF44E83D6C74A85
                                        SHA-256:B360C75FF523EB1EFFBD4E9604985551F164E3EFEC13F36B8C766684469880F1
                                        SHA-512:A0DFC1C1B24C6E5D48BA90CE0EB61531C354CAB31401994B888890855E5EF85A5EDE818465625D1186EF685BA752BDCD66438FC32288E6EA063E5C24055E6CE0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..w......6g.U.9!. .$r..&.0...9.|...;..>.G..c... r..Q.a...(..6i..t..L....vVR...lw....y...hiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.._`<~.y.n..#........E...a9L...qE..s$+...hiiii...a.....#./a>..aY..v$J.XKKKK...W.<....%..c>.0./a.h..y$I.......v......."...<.?.0.M=..-`---..U......s.]'.G'N..x...=.M?..v......D.!..^.....9..Q.m.>..]..ZZZZG..P..q.g.Y.n......P.g.>`---..I..~..@.........g..p.g.>`---..E..pD...IY(-..2...X.U.>..Q..ZZZZG.~..0...aY,U...@..ZZZZG.n..x.@M.J.s........:.U./.b1..............u......'....6.X....|.~o.vAkiii.i./.Q..7.yCk0bX..x....S..-`---.#I.....+

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\confirmed.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):4153
                                        Entropy (8bit):5.390703146235449
                                        Encrypted:false
                                        SSDEEP:48:cyKzFK4NPG/egTjF6EweHvNeHfNwguH3nlZeZo8LLnLwGCHcGwmsHGs2Ani3klwp:1Kg9zvk03rE4KtBTwsmd5mclm6
                                        MD5:A45C349F80FCF0B030D1583D03A78C67
                                        SHA1:45C4AABF47F6E8F21E43A7F3AAFF7F6DFE9276BC
                                        SHA-256:761C0AC1595E2D15E0261B8D2201FEF930F45BCF5C98340F54D025DB67E1E408
                                        SHA-512:8F8CAA1A6B7D75F30170D86698C2F26E02A3C1D90217130FCF39494952409B3FBEE0868C4A082B08680F203F86B74D5EBE6D64355AD9BABF1F5AD76A9C53686E
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">. https://commons.wikimedia.org/wiki/File:CrystalClearActionApply.svg -->.<svg width="512" height="512" viewBox="0 0 128 128" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<defs>. <linearGradient id="linearGradient3930">. <stop style="stop-color:#ffffff;stop-opacity:1" offset="0"/>. <stop style="stop-color:#b3d187;stop-opacity:1" offset="0.53316939"/>. <stop style="stop-color:#28f400;stop-opacity:1" offset="1"/>. </linearGradient>. <linearGradient. id="linearGradient3904">. <stop style="stop-color:#4df60b;stop-opacity:1" offset="0"/>. <stop style="stop-color:#008000;stop-opacity:1" offset="1"/>. </linearGradient>. <linearGradient. id="linearGradient3878">. <stop style="stop-color:#79ef39;stop-opacity:1" offset="0"/>. <stop style="stop-col

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\confirmed_bw.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5113
                                        Entropy (8bit):7.936619810260154
                                        Encrypted:false
                                        SSDEEP:96:WxZ9SAxubw9s9UKLQfcA5w9IUwVv7EmJSrnj7ZvmCrlm16j:WxZcA4U9l497wxAmJafZnlm+
                                        MD5:E168A886B7A1ACB98874E398016424C0
                                        SHA1:85247B8FC71D4B079567CABB36ED539421FE2251
                                        SHA-256:DF9C20D1B59FDD66EC7C7D914AB2DCF05C5D7A135FBA1EE5DFB33F723049E08F
                                        SHA-512:BC5A8D661C4083978CF140CDB9523FA64B289D4F720EC3C85CA936CA30DE4F37BE83EC51C407A759C0086C5D054EBF01AA5C403C36AA05E83861F371B70835F8
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD.......C......pHYs...F...F.2.v.....tIME.......Ni./....IDATx..[}t...=..w.dH...@T"PeE>"V...k.VD.I..Scw...V..Z{...g....n[qUj...*-..Z.Q).&b..QA...!.c&.....>..LB.......y.{.....>.......F%JJB....$..|...:...Q......p...3.:......i.....F?..=///.........V.H...].&..\..?..7....[,.....(.D@...).83`.0........6...h......%7Y[{I..h......%KB...'|q...J...."#.8..N...}?.,.<.w..-..s.....:[.......q\.D....PQ.....V.E..".+4. ..X.....d...d.....I....1..r.H`/0.DH.V...s.M=&......... ..q......XG..g.Qp...g..Lh.M.X.$b,.}..:'G.3qww7)........U)1..V.C.v..{.D.l9eIm.$...X......j3..<.t.[..h........G.4'. i.]..u.....6.F...=6...........p{.#.P.Z.&.J.s. SND9`.=.Aq.....(.YWUU..........a....Ab3..N.0....P...C/..&....G..?S.b1.%........E..@.f..4.}.d..]xa...._..@..lYA...X.P.-..p...$v.+..............*.N_.Tt....".ef....I....>Z[=mwV..7..}....:u..k...=.......B.g&1.....`...X.........:e.....@R.f...^6..Y=}z.@8........_.._....mlA;.U?J.%.....`.....|b.P...!h."{6....%}r.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\copy.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2111
                                        Entropy (8bit):7.875754382663259
                                        Encrypted:false
                                        SSDEEP:48:mglnOTo/lbssCAgsysVdlptoKTl2h5fip6pQzz/xyNRcGt7k:mYeo/lHDZd1to4sXfu6ssHcGtg
                                        MD5:70670904C4B157557987B0F7A24D94A0
                                        SHA1:2F7E04659C6BB6DA6657E56CD1F1BAF1B5883C7C
                                        SHA-256:30155ADE9AD1D64EA9D677BDAE9BEE9E46DF6B945EC27E07B988C0E57D1B243B
                                        SHA-512:EF6ED5F39D6E9741A1EFA8FA9C4AD7CFC26ED3DE056DC44C1E3EFFF4E7272F4DE5284F69F7E6E6D4900CD830BE4771A488EF7554C72490080B8602C8DB7EA5E4
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W.......IDATh..Z.]U...u.....i...JbL..P.1......A.~F....b....o..bL .../cPH..} 1&R?.@..M;.t.2.0.....p.9..sn.NGt%..u.^{.>..{.PCw=~:.O.6s..d...x......Np$.C..>r..~..g.......s.[Y...L.0....:&Z..;o.......>...k'9.VWj%n.....$Y>K.....k.5s..5.2.b.....mW.,..'.^..........@....79..b.....X8.....Q.)B..U^..x.Y...^=...<.p...GO....=...nD.B...*.IfT..q]R{w....&...X...L0...0...&.Q.z.%nv.L.=...)..K..J@.....=...x.2...7..s1..x)...v3]f.$4....7...Y&tB..&.[.LB...4.1...u..R..l.U............._...g3L.9..=....P.I@.(.d..*^.W.......U.o..yg.....}x...d..s-X.H.%..L.I0Y..#.)....>.....O.....qU..k.....P."...@bi.W..p..7....C..T...8..Z.r....as.R.....,.. e.. .W...]..c.{...S......s.#...U....F.B...RB..jIC.S'..;....1...fu.....c#V9IP.....*b.&."...O..<t..\..=r(...O..C...m....U....T...^..U.RU.g.I.......V.:...y._.v+..v..o...Rj..P.?n}2....k.15.x..kkkm. ......6.....8#.....%..n|....<{.;&..I,.I.M..+.6.n..V|..mXX.8=.......#......o.........o..e....U....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\copy_bw.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 230 x 211, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):880
                                        Entropy (8bit):6.766956341538328
                                        Encrypted:false
                                        SSDEEP:24:ZDs/6kUuzmGBBw8AkRcciRwcciR34ggSok6iRtrciRMc:+/6kUkm5NksRfRIggbkBRBRMc
                                        MD5:5838D4A177598A54BA3301FC078EA437
                                        SHA1:F2173607FF1C220FEDD1014C56BF46381D6B583C
                                        SHA-256:4BFEDC4BE17B53F40B0FB48A1B51D5BDFB0DD83EC65D02792DA2DD95BE11334D
                                        SHA-512:7CA85EA848198AF3E66950F65B7905AFDCB91FE83725AD315D6E33D4E76A74A495B547D97A9D021F4AE696CEF9E4A06D6EAC3F1E31353C999D8F2364A35B7E63
                                        Malicious:false
                                        Preview:.PNG........IHDR...............o.....bKGD..............pHYs.................tIME........t......IDATx...12%A....l.Dd32DJ....r........d.....fB...#....7..J....._U.7]3....-......&...&...&...& L.& L.& L.&....y....w.<.?.0.0.........KY.& L@. L@. L@. L@..0A.@.).b.....;.j;O...._.....Kr.UuZ..w7Z.0.a...a..z.....J...C7.0.%......., L.& L.&.d...o;....$......Jranw.a.0-e.=& L.& L.& L.& L@. L@.0Wv..s~I.hJV..d..fwI;....HKU..l...s.R..c...a...a...a................................&...&...&...& L.& L.& L.& L@. L@. L@. L@..0A..0A..0A..0.a.0.a.0.a.0.a...a...a...a................................&...&...h1.g...$.id...V>..tlf.....Xx...O..?.s\.P.L'........&...&...&...& L.& L..).b.I....=}.;.K.aw.7\.|2.].ZX.{L@. L@..0A..0A..0A..0..,.Au.;........|......I.......,............................{M..fYu.....q...................................&...&...&...& L.&..o.56...&....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\delete.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):453
                                        Entropy (8bit):5.6618159951094045
                                        Encrypted:false
                                        SSDEEP:12:6v/7nard9kX7YIw6JGrOVex/6sFzSrfq/h:Oah9o7eiwHF1p
                                        MD5:CDAF9D3ABA7E627290B2D4C812227373
                                        SHA1:C50526CB2037DE682FEB2F879AA01FAD61483A2E
                                        SHA-256:9C9373A55FA1AB543CFCDC80308522C677D517DC4837628891B97F66DC96E7AC
                                        SHA-512:799445D97083E44567B63914AC62517216B5A9515BBEE574CDD01FB6A8848B089262A6B2CA6510FC3BBC14896EE8571A37BA1B8DD64C5455017CC87DDE26FB5B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............e..5...EPLTE.....................................................................R.s.....tRNS......-[...............4?.....IDATx...q.Q...3....RSBP/._....>.$I.$I.....|.Z.........yAz.Z...d..............>..@ I.:........................................................................x...=+..]+...+...*..m*.........`...w....4u..F4?u.....t..........2...6.....v...j../._........O.....E.+I.$I.$....MH..r....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\digitalbitbox.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2964
                                        Entropy (8bit):7.88984074103265
                                        Encrypted:false
                                        SSDEEP:48:9D/66ZAaiRvAFzDm2aDpXcMwf26VAqVL7Lgi4+ASvC8g8t+:lS6ZATeJm2kC/Y2C8I
                                        MD5:4648FB45C35D90272841644CEC7F5772
                                        SHA1:F2D0C1B4EA9CD8F1E679923E69E3EBEBF2506200
                                        SHA-256:8717CBEA4EE2841D109027C98253177562CE60D75C2D94D613E598509FA37C0F
                                        SHA-512:5841D71841AD3190073971DE7F8218C657D84105B671DC0F641224C0CAA889F1727E65544BC89FABCCD29B8D5E8FF358759389DC09803604A82302C913B80B2C
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs................4IDATx...LTW.......f.l.........].HlH..%..v[3.%.F......t..5.b.u.5..]-Mhuk..Mj....v.dW,;...E(.u..8..v..7.....L2..{....{..0........q.u....0p4.N3.4.S.7.Ar..."}/..eY.,....7obpp..'x.6.j..".2.\."".s.......l&..D[.lQ.\..e9P3..p.<a...QII.. ....I..+..~.i........?.xN.Sy..{...+.P:...c.g..q..|~....w.Um..fy...4{.l...h.....8...!A..,.....(..t:..yZ).....f3...E. .......... I.$I.t;.$A.E.<...A.......O..m..8D*%..P.....j....j.5..h.5..@..&.@...P....P.....j.....V..*...P...w..@.B...2........c..S'$IBcc#.....y..^L3...W.GD.m.6.3g.Rq.I....={6m..DQ...p.@;8^._gg'.....M.....c.y..>..S~...dFZ..~Hyyy.,..B.N..g.WNN.....^....J.C.A..OSRRRX.a......TWWG.I..........TUUE..{/. ..T....g-aJJ.UVVROO.......I.....[.z.j2..JM....8..@..4>>....q.....A.l..p........I...J...U....PE..B....Dz..'........=JK..U....S.........JimSS.r.3.8...w/...+..a.:...... ..D.....n.>..v2......=.>..........o.!.a..-555.........y..)U..,{.OI.h``.J

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\digitalbitbox_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2549
                                        Entropy (8bit):7.877892167190726
                                        Encrypted:false
                                        SSDEEP:48:9D/66QSPFWXHpielhcyxPFuOk9YLyowam9BSZuVNLeqCJ2GnWGE/XbwwLRVN:lSaIXxhcyxPMtswhBSwVj9GnWzRlr
                                        MD5:48E5661CC85AFD4584870B031E82F2CC
                                        SHA1:CBB45299465B71FFBF2124A0C318AF434FDED003
                                        SHA-256:42BB7B322669B0117F1E354909B64D48D0C0CEC775B700118632175A782F3B2F
                                        SHA-512:8D886C189309AD7012A414ECD9F607D53479C2C5170B0A7691D13989C4208757655A07C6AB46B0B66E4CA53B85060F010ACD1B4D927B7A02B6686071668E3645
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs.................IDATx..[h.[...L...XSm..l..|.T.=X.R..A...E....h... .|....**Z+(..6.A...'.mKZ{1.V.F+(&s......L..[f...`.I....Y{.....p......~.}..8w.}W...a@_..8....."H~.....M..,.$.2......>}...}5.p.....L.e..A...o.PTT....8.N...}...!.r...r..0....a......6..6....u+.^.....,.%.......W1o.<..b...8...8.<.^.?.W.\.{...b8.....cAD.@.......x.".A..?-@.[...Y,...S{..j..!%%.MMM#.....DD.....y.$.$I..u$I"Q..j..O...w.V...9.k.<O#...d....h.4..f.4...M....M.&@..i&@.....h....h.4..f...z70R*..].%p..\$Nz...mV..?A......l.$I"..C...}.S..n.........}.0n.8...A.a.;...M.6A..~......?._[[.....:i..u..q.FK.e.>Z.H...v..-,\....y^.p.@..^yyy.~..FK8.^... ..{..RSS..F....\.\.v...a.DQd.dWW...9.)S...`.Z.....Pk.'O..C....W....Q.$I.....,]..)))L.|..(N.....&%%a..x..O.AT_...a..,(dgg.........tW..;..P.{.1X.j.........Y....-Bww.q...=..O.<a.....c....@.....v..D....'O...+.w|..1...AD8...q.O.>...;w.....:.....HMM5d^.8..'Nd*~Y.5.S.$..~..K.d.......{.Y....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum.icns

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Mac OS X icon, 830527 bytes, "ic09" type
                                        Category:dropped
                                        Size (bytes):830527
                                        Entropy (8bit):7.988734354922088
                                        Encrypted:false
                                        SSDEEP:24576:4VKk/Nu0LACehvYVzrFodFCJurMCqJPYXnVnqzZBVKk/Nu0LADR:GV0vA3rJuwR4nVqzZJVGR
                                        MD5:2B8025B601932267D73F0575FBAA300E
                                        SHA1:7218DC0CAB6A228529FD9FD498C29FC6B74BB9CE
                                        SHA-256:B4F6CFE5334B31314C0E17C6B12661D2A559465D5D90C39EC882075351B2E0EB
                                        SHA-512:78CBF22FCF4E74BCBE39F99A32F002C7815B297A61B539DAC85478A3FA9D87456E18DD3C4BD545C499C9B67EA8BC5CF9E55474AEC636D691485ED9469001A258
                                        Malicious:false
                                        Preview:icns...?ic09.....PNG........IHDR..............x......sRGB.......@.IDATx..}..]E.....N.;+Y..v...(....w.t...:.:..,2...........+`..\f\0?*....d_..d.N......N...{.;..^'UI..Nm.:..n.".D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."......G ..Y..#....t..g..Rc>...G ....*RF.".....i...dE.|y.,.6......<5o....A......9.\..3.s../6h. ..+.i.X.i.@..X!..+Y.<Y..4MN>O.7.)M..M..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum.ico

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:MS Windows icon resource - 7 icons, 32x32, 8 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
                                        Category:dropped
                                        Size (bytes):63932
                                        Entropy (8bit):5.998406396761299
                                        Encrypted:false
                                        SSDEEP:768:2Bm/HQOYfp/9DRbYlbJskBsIqZ6zsS9ejNPRBTIHW1Q:2BUHQ9polbJXBrqZ6z4lPaSQ
                                        MD5:8AEC9FD7C3D563FAED700948BB821327
                                        SHA1:8ACEB0D85B7F08041B411A9AA4136B561C05F3CF
                                        SHA-256:2C4FE327580AAD0AA4B30FA15B2770BBBC0736D28C849D1B66C6767127697C4B
                                        SHA-512:CC3FFB0A841436400A41BC6C4A8308139B83822D0AADAEF429111E326C72433B0BD324F4F6B810420CB5B3CEF855DC32268FECA5CB4F0D80DFF33A8CC2BDFAFC
                                        Malicious:false
                                        Preview:...... ..........v......... ..m......@@.... .(B..$v..00.... ..%..L... .... ............... ............... .h...T...(... ...@................................hB..hE..gJ..k>..n5..r/..jJ..o:..mB..r2..jL..p:..mE..lM..q=..w+..nI..pD..mP..z(..v5..x/..sA..u=..}$..y2..tD..|,..v@..tJ..rR..qV..}1..uM..rX...+..uQ..zA......xO..u[..~A...:..yU...#...0..xZ..{S...$..x_...A...4...M...G...;..~X..}\..{c..}`...6...K...C...5..~f...^...+...,...e...[...a...<...e...j...7...8...f...D...[...I...n...N...;...a...]...F...>...r...Y...e...L...v...l...q...X...J...y...^...|...j...n...s...~...m.......}...x...i.......m...[...........f...........m...t.......{...t...........................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):24089
                                        Entropy (8bit):7.979796035819619
                                        Encrypted:false
                                        SSDEEP:384:qlD0+FRH+p+hd2dSNjPXbf3dPX5lbdVdw8M/wd/H74:qlY+FB+8hXjf3PVeXwR4
                                        MD5:2F9FB1639D1729737DD597193DB2902E
                                        SHA1:F418635F30225415734F5E0629CAF14FD28840FB
                                        SHA-256:0B93801E52706091B5BE0219A8F7FB6F04A095F7C5DD8BF9A0A93F5F5D6ED98E
                                        SHA-512:FBFEA5A7E2AB2AA9EFF6772C488F47E4BA9DF0923D8F395EAF850612FAA0CCD1CB4F12C620A876D909C4859C97FFA30B20A91BE16B163471441F84D5E22FA8F0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a...9.zTXtRaw profile type exif..x..iv,7.D.........`.sz.....H..T*..5........|............O.5.rm....O....s....'.?.d......../E~....|^?.z....>_.......N.\...F}r...sG...p..?.w=.?...q>.....~....Se1v.z1.p......'E.".8...>.+.?.X.5......O...O.X.g}...-...c.?....>....*..#..?9.vGo....~.......>.H.\..P_.b........3...o....g.k.G........>......_.b.'T~.a.h_k...V.[.....?;6vb.s./..{...]..5>y{^.<.c.........].}e..?.{... ..6.s..W.!...i.........mld..-s...3.%f..l+.>.';^.../....X">;s3>..O.1...B..ul....CLa..>..6w.R...iA..{......6"."......r*.[...1..s.5...(...K)...F.5.\K...^G.-..J..Yo......z....|.H.k.^?...3.4.,..6....Yi.UV]m.5v.q..n.]w.}....t...z..g........mo....}v..]..........(....5.\..%..$k...<;^...t.=...s....b.....c.`:>..........X...o..v.i....9....s..o..k{..F. y!k.BF...6x...J..;.d.B.......-b.}........"..O..Wp..%....t..w~...WW.Iz....|g...7...|6.W.*....W.......^...g.7.....N..Dld.........s..M.z.......M,.+;.....8/[..;.../..*.Wn......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_dark_icon.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):6.37699756090789
                                        Encrypted:false
                                        SSDEEP:24:h8cNNOsb4p/6jaX3jBehgZ+RN2plWwIlP1EvVkROCU0IW:hNNo1p/6kX+RgEQ10IW
                                        MD5:3B5D3CF1678F1B2C1B24D0AF19CA3CFF
                                        SHA1:F1FD00A7B2B059FA9C672BCD5FE09EBF8150A8C5
                                        SHA-256:37F2A442446F7AD873DD3A1AE99DB802E138BC931E30A1B5BC8836C77DE550EE
                                        SHA-512:A73E459A288F62B9659A2A4F8AFB101875E89E2642AE93B3A93B76C56B1FF5E427380F9531F5DA9E922F38BF354D6B99D8D160CA619AD95DB57A9623EA61DA41
                                        Malicious:false
                                        Preview:.PNG........IHDR... ... .....D...... cHRM..z%..............u0...`..:....o._.F....PLTE......995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995...G.......tRNS..,....#.............%ur.Z<..(.{....[Eh3g......S@;.n.)....:.....6|T....z~. ..O]...b.4....&t....QFm2`....Ds*-..p........$..>}....bKGD....H....pHYs................7IDAT8.SW[.@.."..".....A.....Q.b.^....w.!Q...}..a....&.)../....5....i.&.U..,./(,..........k......e.z...q(7Rj(+U.L...f..,.....JH.y....R!0.&.*;g0p.*..`V..p..U....x...zq....[........:.f..&.mn.......}hi..&.,.....p.[.~.Spw..P[P.D..].n.....#.X..v.@.0.}.....Ah./....'....2C....FB.. .....a.1.q.36..Q ..1..G.L.=..R.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_darkblue.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):7661
                                        Entropy (8bit):5.121643197322132
                                        Encrypted:false
                                        SSDEEP:192:VkLIvrtV8H8yJoMH9mfL+RgGEVqo+RgGE29b+RgGExG+RgGSeJFVFNVq:mmtcx+MH9TEqTEFTE5TlHD4
                                        MD5:40A5D164613BBC21908D960A95C59BBF
                                        SHA1:803C4477F54BA3C2F177FC38182FBCC4C3A69294
                                        SHA-256:D11761E14256E2833E5F18EF84D1E39F945AEEDB82313D4D69B713D3DBA1946F
                                        SHA-512:6E4857974F037B8452B96EECC77C57751027DEF65174443F88F57C9CF4BFB314B31502611D1F8426B0E0F6573B92FF6CE24497C3B0F90DF8819A4C717A4BB506
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.1". width="779.8111". height="779.8111". id="svg2". inkscape:version="1.0.2-2 (e86c870879, 2021-01-15)". sodipodi:docname="electrum_darkblue.svg". inkscape:export-filename="/home/voegtlin/logos/electrum_blue.png". inkscape:export-xdpi="10.014582". inkscape:export-ydpi="10.014582">. <metadata. id="metadata53">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_darkblue_1.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5255
                                        Entropy (8bit):7.94512021036659
                                        Encrypted:false
                                        SSDEEP:96:87xJ+McLLltwsKBXQ/saCFjHEc0TBBMPHaF5TKvPOlu55w7GxF4:87+zLLlVuQ/saCNj6wH2TgPOlomuy
                                        MD5:340DF27632B9DE46EF15C1FC98EF9674
                                        SHA1:EBB2A8385B7933B9F8F4EB71D577604CEFF067EF
                                        SHA-256:E95228EC7FD1C019E2A4826186A440F2F806FC984653B06F56F0A4357A9774A2
                                        SHA-512:4E8E71ADFEB5E62063E891B8C2CBB136BDBEFBB4951E90C12E9434A516413D461E8F0CA75D297F58A4EB9C5A65DDB51C8C92113C88724F6173DC61972E21A179
                                        Malicious:false
                                        Preview:.PNG........IHDR...C...C.......s....pHYs...D...D.M..\....tEXtSoftware.www.inkscape.org..<.....IDATx..y.T...nw.>..(.1.qI"Q3..`..(F|... "D..{D.A..%.'...h".3C$n.HTf.D...-....6........r{.{.F.'....s?..9..~.T.S.*_.G.?..O.%.>.|..d\S.=8........K.......".?xv....D..:.D......v...s..B].1.^....^,...<..A...9.>.2..uXs..a`@/.N....4T........U...pB."...#fn..~.U.i..C.kP.....q.=K.......].C&..J.F...%F.a...`.n....:O\_Lq..q++........G..S'z..M.R.F.......`.jv..a...:.....a ..-F.:$..5..t.....UTg..D.X..tTF.I...F...@dj.....\.3..w._.b.R.r....*`>.J/..U.2S...7p.0.(.=...E.H._N;.s....e..U..A.v..2.W|.6..,.~...L}..h.G@i..q.kN.u..!.w......D.W..B....o4?.../...=.aW.I...R@D0ra>..6.7jCx*...n.....Z_3-W .t6......,G...|.va..S|7...... .5.......z...rh.Z.~...O.).x.Q^`H..E.wR%..|+......4P.*.5..`.>+....W7*.|wc..?..#..e8.....4.#..+..<I.yR.+..f$p5$.[.*...B..=E...t~`X...m....S[.C.r.<^....._.hC...9........Ln.z.uhcx#.,0i..)........r.;e..8..H.+..jc.^?..W/@..R.2....3...8$..<...*...%.o.....}|z...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_launcher.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 136 x 136, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):12312
                                        Entropy (8bit):7.968450055550998
                                        Encrypted:false
                                        SSDEEP:384:R6Xu25TcIdJUv//QTtA7l6sLH6gw0s/D8wUQv:R6Xu2Fcnv1lFLbw1Jv
                                        MD5:59D6607E00BA5A052AFCC211560F87BE
                                        SHA1:67198BE2EDECCE3377EA08935C1CF39421756F5E
                                        SHA-256:EB6AAB81B500F634F1395A497BF8A580E8C9710899087F54BE5CBB3742120F0F
                                        SHA-512:54A561AEAB356BF126FDBB3C349D69D900A79D05F421C3FA66052951D297F92980DEFDEB37ADA64FCD1249A92CE8A6BB0DBD56C9C9E2321238672F2685FCCE87
                                        Malicious:false
                                        Preview:.PNG........IHDR.............<..R....bKGD..............pHYs...T...T.7..R....tIME.....!.TB... .IDATx..}w|TU...s...lz.!$1.$....H..J.E@@P@.. .....(".."..E..A......j....}..v.9.....M(O..Y......sf...A...4Q...n.A.5......DM.i.&.4Q.@... M...&j.H.5....2..b<p..:".f-A....>B...9.L%...M.N.#.V'.g".F.2..L..]b@...dJ/.J]..6.......K.J..y.^;..P..<d.v.ct..zf...vC..Y.Q.\......G.../.%.a%...=.5n.'..tG.T[g.)%...G...N......!FZtpe^.x:r.r.5...9w.....#.:T...0.W.po..$27..\.}..c.Rz.L^.@..~...8.....h.j...D.._E.6./^....1.&".K.......~Kv.s... ..Cq..e.4(QJ)...w}.../.....wf.yw....E..F..%.....:}.....x..>ra..D.7......!.T..(.. .=...l...'..........5...Q..o;...K...... .s....g>.e.R.!..........K.8..."3r.. .`op..A.....h..b....4a...._.....(..x$U..QS..>O.S.@Az:..A...@.$E.7%.o..<.....h$...2`.]_....... (,...`..\T0&}*.|x....8{.V..J.{.......Kx].t..=.o_.-.q2....tvc.|4.i...i...'..KG....+:._.*.f...U.W.L. ...F~..S..+.@.....).zu..H.Xn...(.\....r..^.A.m.!.&.N........w.y.b..v}.K...{I..c4.\~....!e

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_light_icon.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):1268
                                        Entropy (8bit):6.575111062657472
                                        Encrypted:false
                                        SSDEEP:24:hYNOsb4p/6jaX3jBehgZ+RN2plWwIlP1EvVkROCU0IW:hYo1p/6kX+RgEQ10IW
                                        MD5:F1682140E4059EB2AFAB3FD9146F11D3
                                        SHA1:837D7266F349E13F178A62A7254E9E7BEBE68D2C
                                        SHA-256:1C947F78BF19CB162CDE0B53EA02C2E39306D0B918B53E82457B1FF5565F0127
                                        SHA-512:E719D3FC5B57EBD12528FBFF4008D0FA91B04EE725EA0F49E22501B10396396822FED2995307FC38C790D25FEFC7E1C7E6AF40151672D85CDEC5EEB990A5EE86
                                        Malicious:false
                                        Preview:.PNG........IHDR... ... .....D...... cHRM..z%..............u0...`..:....o._.F....PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................^......tRNS..,....#.............%ur.Z<..(.{....[Eh3g......S@;.n.)....:.....6|T....z~. ..O]...b.4....&t....QFm2`....Ds*-..p........$..>}....bKGD....H....pHYs................7IDAT8.SW[.@.."..".....A.....Q.b.^....w.!Q...}..a....&.)../....5....i.&.U..,./(,..........k......e.z...q(7Rj(+U.L...f..,.....JH.y....R!0.&.*;g0p.*..`V..p..U....x...zq....[........:.f..&.mn.......}hi..&.,.....p.[.~.Spw..P[P.D..].n.....#.X..v.@.0.}.....Ah./....'....2C....FB.. .....a.1.q.36..Q ..1..G.L.=..R.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_lightblue.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):7510
                                        Entropy (8bit):5.122849632068533
                                        Encrypted:false
                                        SSDEEP:192:VkRIvrtwS8yJoeIwefLaRgGE8qoaRgGEV9baRgGETtaRgGSeJFVFNVq:mUt9x+eIsTETTEuTEMTlHD4
                                        MD5:663AEDB05ABE2CDDF526BB2E16F282AB
                                        SHA1:7576696B929E9D73278207AA4C8DADBAC60D6F57
                                        SHA-256:8BB443BD471F039A1900FE5D04147A8A96FB44A0BB830C1A9117C4886DB69CAA
                                        SHA-512:3DC3A4B256F3197F64D3EF2BC0F42F4440B659F412CA9E1D480174CD40072AC3B36618DF13346843C0CD72CADB56E644D41A18909E8D131FCCE6BA301B2105E6
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.1". width="779.8111". height="779.8111". id="svg2". inkscape:version="1.0.2-2 (e86c870879, 2021-01-15)". sodipodi:docname="electrum_lightblue.svg". inkscape:export-filename="/home/voegtlin/logos/electrum_blue.png". inkscape:export-xdpi="10.014582". inkscape:export-ydpi="10.014582">. <metadata. id="metadata53">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_presplash.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):25916
                                        Entropy (8bit):7.660462274725344
                                        Encrypted:false
                                        SSDEEP:384:UluH3NJNR+2Wj1/EzC89IOJIzki8fhNr/s0zLHTHX/9218udkr:8o9Jbu1MWMJIzki8DrkWbXF2rk
                                        MD5:E2AD368C2AE3B70F2F9A36B0C62144D5
                                        SHA1:E13FB5A28014344A78832AA376558CCC6CF36B65
                                        SHA-256:D738781249BD3308EECCD00537FE44D1A145E6B18832338390FBC85DC15E35FC
                                        SHA-512:F86557240B73F9DF955D6F3BF30A96D67D061CB97CB53814AF2E3138C38767BDFA29DEA6E67C02FDC3626CF69E4775E561CB1AB88E7EF493CB591EFF21400D72
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....qiCCPicc..(.u..K.@..m-.V.. "...C...8j...)..U..B..K..W... ..k.?.UpU..E.qs.."%.k.-.py......w.?.3......l*)....w........m-d2it..G..x..^..:.@A....#.e.w...[.%x.x......q....o..x.&...`....~.S*.......i.WX.<.&!.\Y.<Fk.6.H!...*...1.&../..-.L.F..Upr.Q"o...uU)k..........$..$.|u..I.w...\...u.g@...6[.2.i..ZK.......)....0.l.\nH.Z~M.>...<0|...{.j.....m.....G...7...|h........pHYs...T...T.7..R.. .IDATx^....E..w.... H. .N......g....& .H..E.Fo....Q.}.....:....!=...........n.rw...v.;.7.....3.R..@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrum_text.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 326 x 67, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):7439
                                        Entropy (8bit):7.950993607765179
                                        Encrypted:false
                                        SSDEEP:192:a254DuRPm3ML7dsr6VPpDLwxTUob1J0GNjau:a2WDcm3yagLM4oTNWu
                                        MD5:BB1928F3F68D01269AAA1EABDAB6835B
                                        SHA1:6A3C4F650AD3ECA30512769D0B1A2400940E2DC5
                                        SHA-256:55BFAB6AF8D6C82AF2E039A1F02210AA486D572E96810FE533B01E63DD4F2666
                                        SHA-512:25E4B06DBB51E42F37F32905054E74C76C70CAF27253282A0E85E20F853403817CE3F2734FE42DA21A3AF62FB5DAFE95CD0B77E280069448E3837383142BE284
                                        Malicious:false
                                        Preview:.PNG........IHDR...F...C......m......pHYs...T...T.7..R....IDATx.....E..........9.A.PA.8..O.(.D..."H.%|z `B.;=E..=E%.H.I$.%'I...z.wgfgfggg.......\OW..VU.lT...a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0.......4.@.P[...O.3e..).o...s....p..F....r.q.....l.G...+.6..dw.c..I.)....L.6..$..{n{...$..T@...0;.Uw'...'L..s....r.a..Z.L.M.j0.dv.lE.Z.V$.R..*.N.u..].. .R.=1.[..J...K..a.+/'...k_ll....i.c....?.}..Q.Q..F.>..M....|.geG..W.v....Dv.se.J....t^...C..W.x.>K.....X.m.X|#~AK..?&rs./W.\.to.&..u.[.'.q.g..J]....:mu\Qc..O.y8fR._._....'.LB..PW[-w....?.X......I.|.[..j..6...o...IN..b<...Q)q5N-...?..s.F.=...t..X.P.U...Z..B.q.:8~.{..@9..*.....$.C!y\.8y....y...BVv.?a..H......>...^!.J..O.,.}...6."..q.(.D.sxws..&.</..[.c.;.\j....S.........g7....g>o%.. ...........4*=...!?%t....q..gE.".....r].n~..].<.K.0..8+.UJ8A5N........@rK.=#ikw...h..p.6.........+..hj..:....l..>.u....D1..(.....ST.).......@.&7...K_.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\electrumb.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 163 x 148, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):2510
                                        Entropy (8bit):7.888842297003142
                                        Encrypted:false
                                        SSDEEP:48:cB/6mGU6ToQRR/Q3gmPQ5mV1KP1GweR4IrndDuZMWTQ8NUXLXNovrTaSrJwSOndU:+S7hbDWgmPM1b04Ip6CWTQwcerrJwSQW
                                        MD5:9BAF924AC5D7086FE1427B8E16825707
                                        SHA1:349F180EC748B6E9677436244A836C8BB0A07224
                                        SHA-256:FE3926386E4EFAD5EC7FE9324509E4A12C703417FBCA7EFB8BD03C435B1C23CD
                                        SHA-512:AD2120D1DB9F6869F9B65FC0217507653F7E2C47B597964E3017C6CA5E07382ADA0FF20D14BE93AF2C3637DF22C4C049A11758FDD0F095122196485E58182E43
                                        Malicious:false
                                        Preview:.PNG........IHDR.............U.Q.....bKGD.........pHYs.................tIME........"...._IDATx..]AhVG......_..."....@.K"......A/5.(h1..!A""^=y.'.....K=$./....F"B.Q.'.hM.O.Cl..........)....~.....]..RJ)...B....m.-<.&...UlF#6.X.K<..f1.g....c.-a._...<.>.T.9...I.....=..Cl!C.....^...[K.;.wm...m.....6.....7.B...i.WV....p7.D..-...8.<<....ch..y....HC#7..).[.0...x.w.xA..2.....vn..y.........P.M.x.K.8X%.4....s......?gv.h~...f#w.O....:zw.e.?3.T.!?...>Oj...>..Z<g.).....:k.-..G,+....N.).....k@a...@....32...T..8.?..|A..*.7..O.+ ..yLh.......A....H..\.>.O..@.1.)..M...1.B66.F_....YL...:...H-..kf..#..N..Y....-....9u...K.. .#..i.B.... .r...w.e.Mk.v...2u..9|u........J6rw..!B.._T...a.....G.V.z.m.5.R9..Q7.2.......[5..pjn..Z8.?..jt...xH.... ...d.....#...y0RSc).#.....@.......>\.....Q1...9...9...=e..X.....,$C..j.H.d|..8`......A.ko...E.`...0=.....d..c>{.Cr/R.{p...2....n.k..x.1.ZV..x......{.....>.....'M/..D..U.f....^....S.l.e.T...Y.".:5...8r..%..D..+.`.y...f

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\expired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):28522
                                        Entropy (8bit):7.923983218809425
                                        Encrypted:false
                                        SSDEEP:768:7wsMky1PGVyYNHwqMXl0QO/34KIu6/gShOdE/+ljF:7wswGVyVqMXeQOgKIzPGljF
                                        MD5:68AE369A54DCD7B6D0420C6E980E6A03
                                        SHA1:D16551DBEAD0E2F01154D4921514F67FBF868DE6
                                        SHA-256:21FD0371214571ADD1005346F98391C8A05AA5F3116ABBDCBDD06E54EFBDE606
                                        SHA-512:4ABF6BB49856E8316D4203061A94D8BAF666102877CD374331FA8532DDB2BE21610E4FBA3D745C59E26C977C7EB64503954AB16BA1866C7A4077924E01980BB2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............\r.f..o1IDATx..]...D.>.-...oc...,u.E@P.R.)UD......`....P...v.".O....(XP...m,l...s.$.z'...@6...L....9mf......J..m..\.6W7.`....%.L...n.m...2.w.A...N?..d...70.z. ....q...@...]..B#.D.......n...H..:.f..Z......>.w{..je..vn./0C.6nO.K.l.........2N....;..;.........R...M...b..nw..l.....q.. .w.....W.6.w~...v.Of.oq..6$.....q..8..I..{....m.w....V. p2...?!!4...^... A....Z....~n.=...S..+q.k.d.......^n..q..Q..e..8....H....+'M...:.~.d`.x+....@.....w....ia.l.j}x..+~..o.D......e..R......p.......;..........ZA*.'.......p..n[..{..E.]P.!.:Z...ZA".'.MA...........e.u.X.f.R+.<....>..#...B....'5.(#"9'.l.v|;....>.Dp_qw..2N.!...vy...Q..R.5.{......O..h>P.%zW...'w.J.....\..d....zil........d... .....v2.Z..{ny.-.(R.....a=Q...l.......O...W...)...2...}3gBe......i.<4..d(O.........R....>0.e0(g..n......M.l.....5V..UP..e.[..F.-..g....../w.M..[.o..m..F"x....z.h..N...^...mF.:....N..S^./L.}w..fk.=.J.'!.;..m..ct.......a...a........c.....M.ji$..._..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\eye1.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2910
                                        Entropy (8bit):7.909019751618405
                                        Encrypted:false
                                        SSDEEP:48:/Ud8vu7I4tXacl6KlvRpOrDvig7gH/BpjemizVZWAa15ZXH2JX:rvu7XKWBkD6EgH/Bdyfo15ZXyX
                                        MD5:AF5E1B19B9DD704F021416857EFA8B13
                                        SHA1:4ECD31A78CD4EFB2AD4F9D9E6E81B37D4BEDE078
                                        SHA-256:C94D800E645AE2E63A194BC67772E5401848BDF8BF664F102F39D67B76A53ABA
                                        SHA-512:62370880FE43334DCB37F1F167391E44D55B1AC843D15A46A6D243AA79C8AE1935239676E896877FD39F99293CE063A7F20229D8F8B616260F4111D67DBB2768
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....sBIT....|.d.....pHYs..........u85....tEXtSoftware.www.inkscape.org..<.....IDATx..yp......Gv..6.M..9.JH.\*..B.....`....N.aj..Z..E.k........p...i..r(....H.Eb....^..?6..fw...?............|..|.!B..."D..!B..."D..C....Npi..T..U1...V..U.V.7o~...?X..O.3g.2Rj..$L.&....!.uJ....../...[.5~_}....\r[."<..b>RN..K4...\.6.\.}....O....Q<{.,U.....C5....F.....x.=..=x\N.C........k.1.S.R. f.,..!~...,T4..31%&{.#...c.5.^...,.f.X.........m.*Vs.....(.Yx.*.W.rb8.y....{...n...Q.?E.W...._..[7U...@s..n...C^~.3R......Qz=.....?..+..:.BQ.edY.q.<.......F...tb.K..c.l...h+U.]9y.LcsG}R]]..i3......Y..s..,....u,.m!WO......`..g.us......-..1).IM`R...v+.t..mK(.H......B{.IT.7h...g...?Q.....q.*.s.r..VW.........&%[...tQA>O>..._{.o.......dL....)....O.(+...(...#..m......!&..3R(.n...h......@{{'..X.M7\GSs....|UR...;.=.N.;.m..V[.9..$..Fz.PX....+.#3#...F.....0"3/..9&*.9.H...?...;.pd.8m]...h.#..O....P......ILL...../...V.*..=...lX.0.d.<..'..`N....e..[Qz;W]s.?'.,.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\file.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4779
                                        Entropy (8bit):7.489422017671005
                                        Encrypted:false
                                        SSDEEP:96:NAlOXNL5rVVdr5VgoMaqxcY/kY3SVfAD4I3q8UispwTwI5:uytrVVdNmX1/opi4I3qMlTw4
                                        MD5:897DED1ED1153E7B0836E8898300E82E
                                        SHA1:41A7F5CE4CEF08B5D3994B40590F1C60F7AFBDAC
                                        SHA-256:6FA888B5F96C290F66AACF2D902F6B17B7E386FA4BF0BF2C645CA8721480369A
                                        SHA-512:86EE44953A89BC9DA715C9A7B68B4376D2BD38F14DC5072EF590F8BB70C88C2F68D1231E4D418290B4D161E194B75C270AD2E0125AD7DD7262F4CDE2675FFF99
                                        Malicious:false
                                        Preview:.PNG........IHDR.............k.XT....sRGB.........gAMA......a.....PLTE....yD.zD.{E.{E.|E.|F.}G.~F.~G.~G.}I..H..L..H..M..O..H..I..J..J..S..T..I..J..K..J..K..L..M..K..L..M..N..O..M..N..N..V..P..X..]..^.._..Q..Q..R..S..P..S..T..T..U..P..Q..R..V..V..R..S..T..T..X..Y..Y..Z..[..T..U..U..V..V..W..W..[..\..]..X..^.._..b..g..h..i..`..{..|..|..}..~.....X..Y..X.Y.Z.Z.[..a.[.\.\.].].^.].^._._..a.b.c.c.d.d.e.f.f.g.g.h.h.i.h.i.k.`.a.b.c.l.m.c.c.d.e.n.o.e.p.q.q.r.r.s.t.v.w.x.y.y.z..z..{..{..|..|..}..}..~..~..~..~...........................................................................................................................................................................................................................................................................)`....tRNS......................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\freeze.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):4328
                                        Entropy (8bit):7.917063105549831
                                        Encrypted:false
                                        SSDEEP:96:5eKnaW8i7leOeG+O8WZxBiXAazywYTtvD0AnR3dX4wpNOAvtz:5eKNl8GT8QXYz+TVn3phtz
                                        MD5:F2BEC482842D6EA87DA2610701D348E2
                                        SHA1:2AFEBDB8BE30D7C53B5740D10C90A8DA1C0FD1D2
                                        SHA-256:F3C9D70B977D5DCDF883D07B14CB48D731EAB28C9388CE502F33A2033930FAFB
                                        SHA-512:ACA1DDABAA177FE36EDD753F6E77652861E1329362A5D48FB261E8A15BA972A12C466CDB161B5E99878CE92038A1BF9B3DE5E529D784A550E86674E13681B04A
                                        Malicious:false
                                        Preview:.PNG........IHDR...x...x.....9d6.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....uIDATx......}.....!.&.z..D1.Zm..m.Z"M|)...m^BP.f...A,"h=.@.1.........e.%i...T.Q.kTD.....&...1....O..x.w{.3..._/.`...0........eJ....(..e.K...%NY...,p.S...).\...q*....q].(E.p..i~...OGsM.I......g.w.0...+py..q...8e.K...%NY...,p.S...).\.....K..R9.s..3f4.....X)Z.b.msyXs..5...1cxs.:>..<aR...6..7..Dx..y..c.s8.3..e`...F"|K...(..V..........qp\.?.b8..,.....g.....8...v!(:.m.."\=.J.T..CK[[~...e.........1D......fE.X..:.H.!.@G]./uuqi.&+....x.0.~M....<.[p....m.Y".s..%......`.VVr.5..<.Q.........V.8u$..OH$X.c...h.^....V...KyL..*..r..[.m.Y..?.q..F..m..1..KEX........u`.i.....q.e;...=......#B..s.........X.XE.+..*@B\..J..D........mmD....@2.t..V.....jn....e.Rt..k."-.w..E............Q.i.../...==.....M..i..B...s..;Z..D.H$..8,^..j.6...i.....J..|....._.,.[...q.9c.|.u.b...8|)....wu.g.,.S..*^t]..j...g.?.eY*.$......~.h...T.bK.k...v.8..ExU)f.".A#f..nk.H.Y...9...A..X.S...Ks3.4M.(.t....?..0

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\globe.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5938
                                        Entropy (8bit):7.882084294102423
                                        Encrypted:false
                                        SSDEEP:96:IgbxssDKO3kLnQxyCyVap5OESodKg1XgZPvabCWtM7qZNCoqmWEEOHr5gj9H62:IgdsQKlkxnyVapR3NwZvOMYCoqJPO6F
                                        MD5:F4DD4CE45C589748F88A7C8DE1F476EC
                                        SHA1:268107F65556A9B5F9862A2DF9190102E25D80F1
                                        SHA-256:88EBD17E7FB233C4A26FE09CBE08A53AA80544DA531A751B273B53E94E03F980
                                        SHA-512:D450CC29CDB98BFECE9243C237D6E975BE2A1B3C72325315A9903B369C6E420968A634494F520931B807A48AC61AE6CDC9FE14EAD1EF6E2A2C8A06BC79E9929F
                                        Malicious:false
                                        Preview:.PNG........IHDR...H...H.....U.G....gAMA......a.....bKGD..............pHYs.."s.."s..*......tIME.......K.......iTXtComment.....Created with GIMPd.e.....IDATx..\]s..q=.w.X. .....HP..!...$[.E%N9Uq.TT.G._...r..*.%.m.L.d."EI.H.D.....H,vg......H..l..U[....3}.O.>.w..........~d..E..0.`=....eY...B.Z.e.B..................3..>..EQl....M3......z......w7w_T.y3[.0....\.p.?/...P|..49.4...f........[.E...:......y..FOi.(.......EU...#...8...&'..l~....x..Q3..`..l.0L.8/x..o.Y.......|.G.{.D.M..y.o.8.p.?G........>w..`XD..[r.7.}...U]..n...{z...h..1.A.M..OD..^W.......6.t...?.....=+"...6.\U.J_.J.e9.B..p......I.._..NU7.x..7..u..... 3..:..{..AU.MC....Ob ......l..l...q.h..z..;!..$.y....I.c..#<....w.U.i...y....8...~.s.....x..*".U..'|.n.D$..z..s..:...H{..2.}.^..<8....%w..zEd.............$.>............w.@......MD..=..G...L...$..S...... ...(-R..1p.@DD.}DD.2.Aw_.B8Fj....Z_..+"rTD.......]E...*.Z..!w....>.B...)......D..X.f.0.W...b.2...v......>r.......S7......,"....L..Y..w....'.H.m...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\hamburger.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 49 x 49, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):240
                                        Entropy (8bit):6.393418700587928
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPfG+aWdKcnAI/CBlo3WumGhgqtmgTck/IjUVp:6v/7aaZpCBljujhP4kV7
                                        MD5:4F76DABD56693B941D6A8119C1ADC2C3
                                        SHA1:22F77B79A7AA5F110E231B78DF04EB3C2EEB70E9
                                        SHA-256:5A10D64A13D8F86AF568F42C3A8017D3CC7D1EF8619BFD97B5E26D172DF21294
                                        SHA-512:44D810B84C2E20850AF877870B08B1E550DCFBAE3F58259C86FC1E86E3AC23D494A895F26CADBCD060AE3E772EC2479F46D68D344A3FABDD1B81EB7D1704542B
                                        Malicious:false
                                        Preview:.PNG........IHDR...1...1.....s.A.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....}IDATh......0.......ZS,".Nd^.. .dfsG../.Aa..Hru.XUsn....9.Aa....FP.Aa.E%..G..x.`0....#..=b....#(..0....#(...$g..U..(..0....m...Fj.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\hd.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2223
                                        Entropy (8bit):7.740472932124116
                                        Encrypted:false
                                        SSDEEP:48:JaIFLkqMHmq9q9q99q9qzu88l4Tb4g7vZZcfUCAIxxnsEq4pkI40x9Oalat3ezQB:NhMGq9q9q99q9qzu88lKvTc8ClmH0x9k
                                        MD5:731AAE63A66214ED1268629B506B7068
                                        SHA1:2C395C457408811CC4675B9A726E29F6D1F03C01
                                        SHA-256:A43B3AA5015F0FCA47F578BAE4E9AD8E9E40CFCC3296E2F2CA2A297185F5126F
                                        SHA-512:A753C82A8BD4E3E79E2D980125857C177510A5DF4155768C3FCD99B04B8FB7136B38B9BF9F3A687CEBBA8BDCD05A4F3E7C75F66280C1135A053C793559A00FCC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....<IDATx..{..E.....K)(I.BA.G.. j.H.Z#"b...$.X.by...X.jJ.M......"&.A...i..ZB.....(r...Z....iK[..%..;.;.;{.......3..y.....~.".c.#.....`...8..q\....;@[Tu90...kE._=..i/...xu....L[...0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\......X.~.0'q....C.=..l...]..0a.5q...`...E.>..w..q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`.l..U.".\.u..p....f.I..!".r.\.p........}...1 ....L?..,..Y.9.!.....r.9l...x.*@.A`Y.3..gl'.7....l......^.........)@Y..<W...Tu...D.oc.S.....w.....r....8Sp.......px.].q\.g...!|.`......8Sp...c..x.`......`......g.Y.h...Tu.p.aQ.+G...p;.YD..j,..z,p'p....I"....P.#.+...>..?Td'.U`.....F...L...'.."w....X%"[..m....\.\....[Rt?.[`..#.yb<.AU..+.../.....;.7D.?M.M..X...8.I..n....v4.#.U=.pfZ..M.....Ed[.l/Pd\NX....<.|..ED...h.Tu....*9.h......3.w...F.....Um.>*"..Ou(.:..).(S.7..Ddw..3&''k...q.~....0.X:...099.u:...!../.P.,`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\hd_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2194
                                        Entropy (8bit):7.747910511101916
                                        Encrypted:false
                                        SSDEEP:48:JlHPEFq9q9q9Tq9qOroRkJGp7EEOCJManZ64s/AqSbfezjv0J9/h2jslI1BDK:zQq9q9q9Tq9qNqGpExAManNs/NqfePcn
                                        MD5:7C9CD2F1C58CF0C259F5EABCDAA9F692
                                        SHA1:143A06BF5A9A04119F3D2B7CFFF406AE8A39F180
                                        SHA-256:4EAF310920B4266B69081321D520DEF286824797516DB081DB09CD847C302E3A
                                        SHA-512:9C15A86E42A0BC2474CE8183F4C887E438EEE5786BD6EA970023E699741AF6D684E0FAE54E22E856262CC010BFB74447A8FAD6741EC7D0AA4DC58DF9DEC441BC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..k..E.....ZP.R...C.....)5.D....Q.. .>*..U......`....`4..j...%.....D!.\"..b/.k.......gwgvgw..<.o=;;......w.E.p.r....aq.......0..`.iC.h....f..a...{..[1.....o......V.........0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q...._..H.."...^..6h......b.5q..S.......!C...........0..`...8..q\....q.......0..`...8..q\....q.......0..`...8....|..\.u..p.i....$.l..l9s..8..X...f*p..!"x..&.w...=9+.)@.`N?..`J..r.._......s.X..-..2......|..x..Y.f'..^..%pR.......x\D^(.6..:N.="....T....|.].!.}.\.C....\.Ct~i....x.`......`..........\.C...8.....p&...........@V.Z...U...',.y."..n...V.e@U....N...8FD.....z.a..Y.'.#F.l.........H.U..|...pB.n[....EdCr.-P.#...s.3..J...~...n....I..:.X.\..*r........6i7Y.b..J..&...o.D...(T. ./.R`f../.\!".rg{.".b..W6..I...M"..ED...S.U.......p..<...}P....sZV.......>...L.g..LU..,...;D........\..l.> "..Y..........=.r`Y.7..U=..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\info.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1771
                                        Entropy (8bit):7.863050634593692
                                        Encrypted:false
                                        SSDEEP:48:9laNhVnnXTRYSXZMtq6Z2KDUIg1el8brT:TQn6U6ZVRg7/
                                        MD5:4DBA583BB7498C02B0C5F5CCAFD7CF4A
                                        SHA1:52485A4DED1E0BAE4F91D9E589F91CF5085467B1
                                        SHA-256:C7C8304731844C489538D77D2E1C8618E3140E868972532101CC0760987B6ECE
                                        SHA-512:19FD7AD28C8B05A84DF459DAFD8BB5A117097044DAC266D05139338472B30C452574F098A854B7DDB3ADE8E87CD411CD4A546BE3F8D6D51B049CCD45ED22CCCF
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...2......?......sBIT....|.d.....pHYs...M...M..9`c....tEXtSoftware.www.inkscape.org..<....hIDATh..[lSG......=v..U..IPA.........]..-m......Vj...J..m.v....K[.&Um.E..$....$........v|9>.}H..1..>..h.o.93...o.sf.e.....o.j.4C .H!.....w.8...V.V..$.._........wz72........H.U.W.[.t8l..4....&....t&.J..$....> .y....^.RbwO....5f....2..G`..5>..".*.0..F8....z<....if.~x...!...B....L..`.#..k...Q..<.63.h,..+7..cQ")...x..y..6.......p9..J....5..=h.r;K.z......].G..z.W_....?o.soQB:...;l.S!.e../V..."\...7?.d(V...y........>.......n.nl...vk.].d:.....x<u. .:.........'..X...Zo...6MJ...E0L...l8...M...+.?..=..9x.Q.....VI..%.hX)...6.....:....+T...o.......x=.m.-....$....j^...n....>...W.X7e.%......%~...I...;...t..(Tg.P?~..&.r`..-.....d......E...........L.M...}._6o.5...>PmZ!b.C....;...=D.........LH.......N...jK...l.u9.$|.;.>........f.i..{{z;..s......._....+BF....?....<.V.z.9..\_..0....X..u,33O.....i*...9..g...L...x\...m..........W......_....M

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\jade.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3445
                                        Entropy (8bit):7.919405513986357
                                        Encrypted:false
                                        SSDEEP:96:qe2TP/jq76KuWoE5ymTkOkFpwWDGTBGiuzHq:q/698ERkffuRuzHq
                                        MD5:EE4BA2B73A1F674EEA342CD51B17D354
                                        SHA1:E381C0F26C9A8529B116F739EF8F845606DBA67A
                                        SHA-256:FDFCFFCF836708F270DCD9C35CD1583D1712CCFE690B1BE0F368756FCF85AC57
                                        SHA-512:2D47E248B8916B1C1CE1F6457ADD4A5A91FFAB50F234D17D929A64ADEA03D44CF509FAAA4472C68B3334555F3C1661260470256468C5ADB743676232DC2E59E7
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...........~....'IDATx..\ml...~m.ml...zg.M..pM.&.i....JRR>SHU..P..L...Z.H.G.J...5I1..."..).B.|%.%*.X......;]..a....z.f...w;.{gR..V....g..yg....h..>.=..h..... .6.1.7w..c.h.....sq..LD.DtI....R.....{a.....r.t`.6":.#...r`<%..@.i.h%..'.V..TIfR...AD.$.&.8.{.....IR.t..#!..D\,@..`..E2.w....^.....y..M...F2.wL....J.E.......FG$...N.R.8..LB..#.G`.@....z:...I`....m...I.z..R........%...<....[og.K..4y.y.9n.eO..~o?y.zn^ujx3.e0.r.r....m.@..9K(.l.e..E}..p<.8?..U..x.....v.....OY..T..*."..O!.^...t..w....O....3u.........h..6.MTq.P.>.....m...E...mvWS........x...u..z;B...q%..;...Be..9 :=g.;F._Gy/.S.O[.H$.W......Z.^d.....m+3.I....../.q=.......u....g/.._..k.......@r....+.q1&......&P....=..r.....A..@.$.....Y...[\Bm.....)....=...S.p.=Qs.}..F..&P..l..cJ...W.m....'h.....Z.VG...&._J.............a3!a..BFZIQ.u............j..*...`U.....Y&.KL /I.T..PA.[k..=7.FID~A!M[UA.wVQy.Q.....s....[.;..}.(.`4uw...........x.$.2S.5C....Y....G.gj.A...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\jade_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3431
                                        Entropy (8bit):7.921064358027522
                                        Encrypted:false
                                        SSDEEP:48:uCdGGBsq+ea2IH/PhTHcOXNskoG+2/2bXE3pkb6Ep3DkTaGCS6w6ISJHazAObOu4:jsq/TmVHcCwskmRBDShiAWOMfENjkq
                                        MD5:9531E35DE38675AD0E5F1BF4055D0E6D
                                        SHA1:9C3F4EED41AF519D220FC626DF8C2F536EACABDD
                                        SHA-256:AF909A3D42B8683A4E3680E6A517F832ADCAFE8A4CD835EBCA01DF3B7F3B43FD
                                        SHA-512:C00159AEBF8DADD4A46CE7A89786F9DF827F40A997C0A5B737B0DC7A06A605BB0D2165C78BCF8ADB277521ADE8D0CA0E7FE97644551A72EACB2D6E894BB0D636
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............pHYs...........~.....IDATx..\mlS..~I.......)I(.f.Y2`..V>.`......I.....i*Z.*QR.45......`.P`...`|uM$&` .A..B.-..E......ss..k.s.C.<.........=wX__...:....!.mb.@..".&......w...""..x!.)W......W(....".^....$.......2LD........O.)!.K.z"ZIDyI.. .*U..T.9qo..kI..1.....L2/...]n.(H. .....2...............#B.q.t.........@.u..x.....B'....t.....=.......H...&.....I.wu...!>o...|...1.T.~(.E.e..? .x.........:M^Zv.e..H.eS...S....u..7.....*+'*...a.&.D..YBY.s)..<...q.../......l....m.......<T...{....&F....@^oG+.....#k.<.*....m.......l<.....{..?l...........k..v.CF`G.I......moa.g./....=..U.....5j.:.}.G..o.#..]u..wV(.o6{.i..3.w...$.+.Q..@...:j..n..4..sf/.......|...{...si...m\......7....CA.z....@...R!.9...H..t^k.p..\...P.AcB. ..6.p...>j9RKcj....[..^..*...VsLI w..-.0c.D...?.P..c@Z...T:..y...>.y.$........{..i%EE...B7..............VU.l(.e.....m..........}.z.D....U.taW....pn.{..h.......r..........."2V.m...L.......g.....5...}.......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\kangaroo.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 452 x 452, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):15433
                                        Entropy (8bit):7.920012489860019
                                        Encrypted:false
                                        SSDEEP:384:KbbzWewCmX4GFOHLtdVWIgj00ANXmDg0HYicAgAw:KbHqCYhOH5HR0pumR4mw
                                        MD5:BD9ED008918AD8DBC4A83E5E080CB38D
                                        SHA1:CF452561E68CC1B439C75E32505AAD26E3F466E4
                                        SHA-256:B9F0C0F86F9BD33D5058F13E1A24E5F25F197889EFD705B23212B2D53ED5043B
                                        SHA-512:77D1A83C55BA1F03A4A749E9859116007F4C982F048C48334A90F733EB8F0AD2219909C4661A529021D94EC73BE29BFC788720DE8670ABD116F9E3C44326A844
                                        Malicious:false
                                        Preview:.PNG........IHDR.............._Z.....bKGD............ .IDATx...y.\U.7..snUo.^b...WTD..4........ ....:.....3.:...;:...@.N..v..8#.(...tw.d....}.?:..........1...u...........................................................................................................Q.47...j....:.."......s+.~."...........f....<...z..q]....HD4.mW.o4.........!S"."..o....a.H.!......3.|...P\...r.D..DDch..n..w..U.k..b .......^....8.u-Tz..HD4.}W.{5|...a.` ....ok.2.iW..u-d..L...h...B@.b..Z......N..M..7.]......c........^...n.3\.Bn..HDeo....4Ap7..e.=D"*k.W.....@..Z.-....l=p#.i.;...u-..{.DT....*...h`....R.j...:.uPt0...........\.A..@$...~.U....@..Z(Zx....J!..e./w].E.{.DT6.]U...nH.` .QY.u...x.F.@$..P).......x....o.uo..[\.A...".%Z.R.....q].E.{.D.h..u...\.uP...HD..vE...>.....".%.1.1.w...0..(..]5.%...u....D"J&....\.A..@$...e....u../.D"J......F..7..%.+.....uP.0..(QR&x'x.&..HD...jg..Y.0..(1z{.Z..\.A...(1..^].1....w.|E~YK.......-.%B....C.g.*....|.s.........0.......~..w...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\keepkey.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2766
                                        Entropy (8bit):7.892837039684091
                                        Encrypted:false
                                        SSDEEP:48:9Bs/6U0323aiGMu3+RTfkxly0PwOorPlrO1C9d4PI5A1awAy1xXKwt:jsSU032VGM3qi0PsrNOB1awAyX6w
                                        MD5:1EBB938309C368D0601121FAB8F0F2D0
                                        SHA1:681E7EC01839FB1A554B7C99773051D8AAC81422
                                        SHA-256:138658406FBB5631E86F232914D3682ECC389AB38153C344C98A4104EE8032A6
                                        SHA-512:14502CD433D15B80DA4E6D988CB7EF961B862AEC22A3F8BB0F7A0358ED956DEB6A14B802D937C585909B2332ACBD39304597F57029E60B5C1F96B23B41ADE83E
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.3.7.E8P?#....pHYs.................tIME........v.....[IDATx..{PT....}..^uq.Q|..kC.>f....4.hR..?jTZcQ.h... ....b...c../2i......G.&"F..hD%...8.B.v.>.......{.ww....3.....v?......;..RJ.6.f.#........fR.....QV..w..r466..... .n..O.....X.h.""".-@......9.....{..n{&..........ZKK.S`Rx2...>._y.....0@..9....x..6.......0@/.2h.mL..........z..u.Q.....0@.t#..v\......a.L@T..$....t8....f..o]..C.B.....AcC.._.....(c#........p....A.c.[......q...DDF...h....n.i....a.u5g..q.=.........m......{..A... .....4>.ty ...%........oamA0,g4...9.;..c......0......DE....H(}......ee.!...;#F..+W.p.D&a(C.......ihkkc{~.qqq.7..].G...{...26nD..6.]..AX......f.M....g...$.M...Q.s...9...../........T......}..z......oa...^{..x..X[.....<.......?..coxg|..}.....l..@...W._..{...`..0.q.. ....3v..i..}u@.....L.y7;9Po.....3g.!vd. ..x.6.7.7[..n....=....'..<}B..&....c.hjl.h...x.....O..%@Vi...~.......=...".q(|..S~0e.4.|.. ....;.p..,.............C.dd...)....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\keepkey_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2726
                                        Entropy (8bit):7.885679156988498
                                        Encrypted:false
                                        SSDEEP:48:9Bs/6NrqJ08tTnmYp4/yfJljkrHg5ALnjH/+iPVDY/dzZQIIEDtQtUII0G8261e:jsSILpnV7jkraALj2itD4dFtIStMpG8K
                                        MD5:35A93B6F9C34D75D8E8E5FFA73722C57
                                        SHA1:21AF5562A93503AC670BD8CDB2771DA2B8AA80E2
                                        SHA-256:21E768B2394316BB4D8EBAC274A6E95F3AF87D8B39B5E76EB6CF9377B875F042
                                        SHA-512:AB698CD02BA077076416B55D8D9678B0C138B3EBFAD31A52FD69DB734C236BC36110F9E79490164D427BF07BEE94E5AF87789E7AB3B545E21AD3D80D90F3908D
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.3.7.E8P?#....pHYs.................tIME......("......3IDATx..]kPT..~..gw.......p.6.Llf.-.3.:#6M..G.JbRT4.A.. N4.Q.Z,I.....t2.4...F.aJT.p....! {9..e..|....9....|g..~......J).i..3!0.4.4....=q..]....7...z........ @b.8L.:..Y..;o.bccG,.D-..........g...{2.Il)....s.K.....`R.dv..M...>...&.R..J...$.y...l.{.......&.....].]8s..`.xZ............?.y..... ..2..*.'.....v.L.....G}.R..5....*...6.:y..n.Rr#..c#]H...ra._.E...[...III8y.4b...-.7.....SS.R..#p...I.'.x.".P.D.N...l^....1=P..6=/...r....!..2....../xPs..#AS...0.sT..M... .*3..p...Sf...M........7n.Bm-@....1....C.@".0.!m.l....by......nbb...@..Qh...aw..A.U...P..8*~.0L.X.F...^.]...V6M.!....o.....b.<._..}....1.j...@.._.s..V.|.S(.sF..q..R_....@y......{..G|..}...\.l......N.:.7.mc.*..}R.$$.K...........*......cc~>.....h.GNIO....al..aX...mkm...CoOo.Y...?WT.....i.."...>.^.....Zcl.X.SQ.........H?....a...'.4@..l(.S9&.t.cPL..a.(.".lr.|mmxU.........y5......(....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\key.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5428
                                        Entropy (8bit):7.949392842023817
                                        Encrypted:false
                                        SSDEEP:96:xSIK8dZ37PTa2Axpa8wqVfx/3oYBdIM9TGBFAW/CG3FFfsqctJecttHMK9:xSH8T7u2ALDtBisTWFRH1F6tJBN9
                                        MD5:8B6004564A09C5CBC57FE5E7ABCD7B56
                                        SHA1:59B3ADEFE7ED3EFA5484AEC360F658A38FB8EDD5
                                        SHA-256:6683C3D397403B789F4E3F13CCC065A0A863830F7393EDED843DFE6075971A49
                                        SHA-512:FEE2C164C7FB28EB29931EA24A19072F4BAD031CC5665CE18B173C336ECE922AB99CC2B1B6072690EC9499BDBD2BA28D60AFBFB738965F1F2613BC6FCE24A69C
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....bKGD..............pHYs.................tIME.....;..0.....IDATx..y|......33;......9.Z..)I.B+..j.?.Ykkk.b...^.z...V.jmk...."Z.Z.*.........;@.M...f........Zm..>..f2.d.s|..G....eL...J16..t.b4..5M:-.{.......ZTe.T..k..G.,U.P9..BrsW........0...s.a..../Q.."mM4..IC].u..}.......W.2._!..p.....d'.L..<.}c&.G}..{'.@*......X.||y.H_......sO..i...,*.j..q..GJ...\...........Ee.i..4.]....i....L.Rd......~.(.6...e..<...I...1o..$Sl...@.G!A..............q.:..._.e5....?P.W"1L..(TF.\.V..xD...D[2hl...N..Q..y......6.U...C@e.hM.q.Yq.I.f.a.....\C.e.//a.h..Q..B)..z...r4Ze.q..v4Zk.Q...\.....s.P..>......5<.a.e.F...a.._;...w..2];X..30.0..)&.P.].r....h.v...h......0......H....E..z...g.[;.Z1...X...p.....S'..q.;"..u._.1S.2`..7.:.^9.`..+....].K...{g.'..24...B..}...H.M.p8..=.....Woa.L...j.G.....[:..{.=.".Y.G..q.......Z]..9 ...r.0p..)xea3..l$. po.Q.5".k?P.n..p.8..".VD.....R2r"uo..........{...k..c..6WU.c......FL..d..v].r.:.^y1.Y?..b...,...:.[.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\ledger.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2161
                                        Entropy (8bit):7.877690949768299
                                        Encrypted:false
                                        SSDEEP:48:Ldqsv/ehL2tSwGi7iMVTg4c0Tl7N6ByL7LLNGxwTNQbOt0wR:5qsv/eFXwGi93l7hXLNGxwTNRN
                                        MD5:1FE78953D56C84B4A21DA0E92D9DD6DA
                                        SHA1:1F7284B2B71574D7EA07AC14F826D1E929C99621
                                        SHA-256:BCED40406BB5BAFF13541CEB9FD03BBFDC485F3C0A14D39B5E56A1ADC021CC0B
                                        SHA-512:AFFD2D9009D92287D0E7BFD0D69670324218FC089F9486251F6A767D481FF1F8267A5D9C75803CE8215EB89DD71A60FDB9D7C40D3D74D0DC689E9C4EEE3BF8BE
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sRGB........+IDATx..ylTE........i+...=h.......A......R....A.9..(BI.....QH.(F...F..(.h...T.@. . h....}Kwy.o.......k.o.o....7o...ioo...3..E......N.....+./.ztW.Z.)<......U............K...C...[U*...Y4...W..n......V....".w..9sm.2.......+.x...Wx.&.....0..D.......s..Y...bO|.{$.7........bj.!......_C.Z}$3...JL.....z..R.=..R.....!U..".=0.{.yJ..@..n'.ex...qJbE.(Z..{...?.W[...Pr....1.{.u..F..QX..gj.......p...9/..f.`!p.l).........]..f.J....0u.$.e......9n6.^.J..BC.Cr.h.....76....R|V?, Sj.7j. o.v.z.=:0...n7.....O...c`..wa..HI...D...I...P.../w.x..H?.[o/........'......~..V.n...a.[....!w.f..$A..` ..O<.......M.$..r-...).K...`.o.._....r.RI....qZ..L...I.q.,+..m.].....`..{....R........b. .m.......)......F.....nX.m21A.."..W(p.|vr.+..gm.C..F.(......r....H.Fu.....{..f..n./..I.....A....c...9q..x&@y.sw.VA...........2@..wH...U...<.C2@nd...<.Uw.P.(HMI.QO....a..Oh....*....w.........X.~~.0{.4.9c*...0.K{{.A..A.V..)........;g.,..............V@|

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\ledger_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2140
                                        Entropy (8bit):7.87248854648818
                                        Encrypted:false
                                        SSDEEP:48:Uu3Yfl72SkZGC20QjtVnna2KRjFhk6MAPV8s6UFh0RodtItz3B+JNnsyDOX:Uu3I72SkZ80+n0jMAuoYoCLB+DnsyDOX
                                        MD5:EC32A5395384BC89A92475046B5FBCDD
                                        SHA1:9B82B1F91E51C41AFAEC4605AF7B8551C5E9FBB4
                                        SHA-256:7AF9A6D6AE06198992E41CAD67DA0BA7A754AB8FA7309E7816DDE96C9F04BCFF
                                        SHA-512:1D3569BEF25216654BC7505327AAC3FB484275600639A9A9477BB4B200ECC71EB90FDB85AC98F9D3E3AAFC931C0EBE0E6636BDF50F3EAFE372A170E5E07FB962
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sRGB.........IDATx..yl.U.....-.(.H[E.B...H............x..Q....CQB@c4....#....9...!wQ...)..............v..vhw._.:...{........Heee.....l..f.u.k..E.A......$I.q..y...F$.p.P....z..M.....$...%.....X....^...........1q.q.|. ..j.=X.....f.....Vx.&.....jl.@dp..V"s..`...jX.k.H~n.E..-..V#.e...FI`- ..../P..o.",x>:...:F....""...O.?..F.....K<......n9...`..a.f..8X.......y.U#..s.1......c.. 0..6.<KG.>..iy# .n...a.........i......$].q.jjTS%...4.<h`.2.-XB....2.."....$.#...=...../.`<..?,....-.R..Z...:s&6.......N.~O..eee.....]:.B.v.<.t....Izc..........t../..#..b..#I.L....4s.B.{.28&.+*+i..{.....[.f\..sS.....C....b..C.........<uZ...k.`.B.k./.S~.O.a..KJN.+...z.&...._..C..z.&.....W,V2.i.0.X...i.....0J......).2..._..z.#.0.g..o.z6Y.V..._c...FI ...Z..$.ev....(<..=w.......z.....w../....cN.V..6.u........(.L.....!...#Sg...y..,..........K.J.9.....S..).'......WTT...(.|........F..B#......B....Dj.:......b...3.cF..IE....-...C{.?w:e

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\lightning.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):446
                                        Entropy (8bit):7.0861494853353495
                                        Encrypted:false
                                        SSDEEP:12:6v/7TaeVxOaw1fQxEeW+k8C10a/AhiaOF3Jy7:9e/Y1fQ/W+a/Ah5v7
                                        MD5:78140684F45698CAE3761FB62AE349B6
                                        SHA1:9088299D1BC1ACCD8157FDFB2E4375D8AED05C0F
                                        SHA-256:954E52C6F49987DAF74AD9341C55874ADA731DEF069DD938842F170022AA2FC8
                                        SHA-512:C7CE40962A051F0CFAE9AA38355201AA4A34FFBE0B65E8CE0464D4015F2AF35A068E99BEFBBD68C947407CD38A93178B63FDAD029A135A43E3091A61AAA9AB0A
                                        Malicious:false
                                        Preview:.PNG........IHDR...H...H.....b3Cu...0PLTEGpL..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3H..%....tRNS...`.0. .@..p.~......IDATx..K.. ..l .&i}....y.w....hF....9".q.3>.....d....rz....LH...*-$.sq.M.4.....K...!..2-n.*W."4..B.....Rv..\..F5B<...ra....)..:"..Q.B......e..t.Y..Q.'....Q]..Fu....k6...F..}$W...,x,...C.......k.+....{.Y.i.bLHW..n...iLH..rq...;..JW(.r...*.R.&.QeB.U&.\T..CC..p.K4.B..v..%....c4.B..*.);.(.D...K..\>T_........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\lightning_disconnected.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):4825
                                        Entropy (8bit):7.953699430939302
                                        Encrypted:false
                                        SSDEEP:96:FPNGemd9jas1Vgkr+pc+kAVw5mOmq4/YfbtWb4wiKhAWvtSM4BEMZwGO8k:vSDjasQpp6AeRgobtWbUKhdvtSd2MBOr
                                        MD5:7F5BF4119481B97CE967C64DB76BE223
                                        SHA1:345C19ED37AC3D699CDF463A2048BDF9B2FCAB28
                                        SHA-256:B3139500B7DB13D25D1B9CFC29D5A1964934610C11250928658ABA4F16449D2F
                                        SHA-512:3DCDEC46C77A36446BA913A939F138BCC186113F55BD5C91FAED98EE52A2163A4E8E259C04363D840CB85DE39E1EA08038D4E16AE268086B7AF6617CD108E90D
                                        Malicious:false
                                        Preview:.PNG........IHDR...H...H.......{.....zTXtRaw profile type exif..x..iv$......>... ...=.....fI#iz..U-ev.$.%".r.?.>._.HJ.I.ZZ)..i.b.......{...^.|..\J..._..;.._/..3>_w.u'..@.}...lf;_...z|..y...sRZ....@...5...ay..u..(^Z..R.;........v.~..........I.5.............og....8?.......#N.y#./...4...............9.....u)x..2.:;.......Z..f..~....|.....Z.x.. a..N..8..D.;*..gL.ZM.[.D.h.'.....*..q.....m.w.v.2..<....^.......|.9.\.|}..vE.k..._." ....>.....c.*<fn.,....1r.+..s...)..t...E.1&$".KH9..5F..?V..<R............4.hs..l.D..6.....T.P'X"..Q..P.)K.d...{IEJ..h1..T4kQ.M{MUj..j....bK``n.i.....L....|..#..y....6.$}..<..Yg.}..0...UW[}..A.-;.u..v?..IGN>......WT......W..=..Q.S}."..d.......Z.H.h1.5.D....HQ..b.V...B.!...c.W.~)n.._.[.Y....9G....oDm........>Q}..X........">......j.7[d]G..|1.......^E.l..o%|K..>....g..}V..z.....9.xe..kZ\.U......N.]]k...v.(<.....V..][..m......P].m..Rg..J..*...c.L...^'..K...=.....;....g.....2G<{..$.!'.9..N*.. ;v;...=T...V...Chb..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\link.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 450 x 450, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):23125
                                        Entropy (8bit):7.913567993722842
                                        Encrypted:false
                                        SSDEEP:384:xBKjOrHWERCVV85p5iKzimD9MX+sbAwhYGAEP0ILW6DpcKDVq497mqysBPSEkqjy:x58Q5p5iZmmnbAqYGZJZDF9iulLG
                                        MD5:95CF2F586590A039AD6A410B52F51D94
                                        SHA1:F5ECD7EAC202F50BBD779BF2848037C1C3997D75
                                        SHA-256:F9DB3A8E50FCB3A75C9E9DD5BAF45940DC97B7A3297FB0453CE3380CAE86C583
                                        SHA-512:FA6E0E2508988B56F9BA9C81690CDE1D9B8960EC86B6F7B9A43A533F7A04B79E0D57A58974D210F614F0DAA352F849286F2254336D2D35E66D5FA413C25EAADA
                                        Malicious:false
                                        Preview:.PNG........IHDR.............K.9w....PLTELiqb.C@..9..^.??..R./i.F\.;9..7..`.@=..7..:..g.Hd.Eg.HP.-7..9..e.FJ.'M.+Y.8L.):..g.Hf.HN.+@..L.)\.=J.&X.7[.:8..E. E.!a.A_.?h.I:..>..f.G^.>Y.9g.HT.2T.2J.'`.@b.B[.9].=^.=`.@...6..N.,O.-D. P..X.7].=E.!\.<V.5W.6M.+Q./^.>_.?C..?..9..Y.8U.4F."=..@..T.3[.;>..<..R.0>..`.@I.&J.'B..L.*:..S.2@..Z.9G.#=..Z.:K.(S.1H.%d.E8..A..e.F<..Y.9G.$A..c.DZ.:R.17..L.)a.Ab.C\.<6..[.;K.)f.GA..[.:?..;..].=H.$I.&;..H.%X.8Y.9;..a.BW.7F.#B..b.BM.*B..Q.0:..T.2^.?T.3V.5J.'g.H_.@?..U.47..S.2J.(`.A8..E."G.$`.AK.(^.>X.89..R.1c.CC..a.BF.#L.)h.IN.+8..V.6Q.0:..\.;P./C..@..7..b.CW.6U.3I.%D..<..d.Dc.D_.@M.*O.,e.E].>d.EP./f.HO..D.!6..>.....O..e.GE."9..E.!............|..........k}.d.....W.7............y.`s.Xk.N..v........m.Q....a.Ba.C..qf.Is.WU.4X.8Q.0\.<\.<e.H^.?S.2N.,V.6q.UZ.:M.+\.<.~.....9tRNS."".N5.....4O.c.c......ds.......q.................a.B...V.IDATx..}{L.g..v.:............d..c....B@n.......p=@. . .. ..H.h...zWl.mZ...cg..v.;S..v.i......;...C6|.}....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\lock.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):40380
                                        Entropy (8bit):7.964394337432647
                                        Encrypted:false
                                        SSDEEP:768:+ab4sv7U2pM2a7u6BurXDFEcaaZk0hLxr+G/uClVkAHChcfJoBfZ6m:+ak84qM2QF4rXDFsaxLxrt4AHChchoBv
                                        MD5:34DC98521BCD82497EA0ABDA704CC73B
                                        SHA1:81DBD99712040045E5CE3CB5FB36E8E7DFAA720D
                                        SHA-256:91012C141285680812ADCD9EEDC663A38C1296FEE3709EA700F48F55F5400493
                                        SHA-512:0FEFDD6685928FD2C72E5427FDA0DD65C3AE1AAA40B6232C7A20420F225E778AAA60D7ABF24793DD16759ECAB0CA9597BE10F4A057A2636A8A275DCDFD0FB867
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..y.5YY..{V......#...(W.A..b...nQos...1.....AI.."...... t+.....{..D.Z..n...~...{...?.V.Z5.]{..O.}..}?...U.^.z...A..]...x......;....+.e.G.ZV....#...W......5..GD.........'.ufZ.x...+.u..:..5":..../...{e_.A8.P........J..PO!....7.|.......\..z.....y...8O...:GJ?...G..<...\(...........7...\.u.kY...<...0.)....{.......p.f..D_.>...7..r...Ye.V...#.....o....,0....b.Y.]]v...g.|.L.%.>..}7...._....e.L..:"......^\.......z..o.p..r.(..|......Z._..o|..B..^C.X8......B.V..]..'.|=...O.<A.....+......WVVt...2.......++.z.....O..>..QB9\$.k.G.W>|.w.*.@..........]_..!0...|#.Uv.....}..)1...o..O...](A.6"...m..m.W|.A..`.. .........?.......J.....4..I.....j....A&z)..C....)&..f....).0.0I...f._..|5y.3.........n..w..u?.X.....".,..+++.f...2..............].....t.).*".....V....K.x-.];...>.LwW...-]f.......y.;.zS..u.....e.G.l...X..w..Ke.F.. .,.Y.l...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\lock.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):12125
                                        Entropy (8bit):5.044141834443952
                                        Encrypted:false
                                        SSDEEP:192:m6Jekp81JeM5I+sUwu7IStmwNvyWMd67Of4mKm+jZLKYx6:m6MkCX9Cr7u75tVNvPOfTR+4E6
                                        MD5:DF4B5D8065ED9636F912AC1FBEAC3884
                                        SHA1:98A87B2D66CA68592DA2E21DF2BC12029FA19342
                                        SHA-256:DAF51089C0614450482A65DE2A5CDE0303B07C3A3DAE87BF011466A91ED4140A
                                        SHA-512:02ED73FC39B111672A92B87C4E8CFE86A2E9DC826451A4C3BB043A5E2777F6EA8079CDF887FE27900184DA97C620E349FB2ACE3C0293A8E307977E3DAEDB382A
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". width="512". height="512". viewBox="0 0 22 22". id="svg2">. <defs. id="defs4">. <linearGradient. id="linearGradient2411">. <stop. id="stop2413". style="stop-color:#fee7b1;stop-opacity:1". offset="0" />. <stop. id="stop2419". style="stop-color:#ebd4b4;stop-opacity:1". offset="0.25796592" />. <stop. id="stop2421". style="stop-color:#c8a775;stop-opacity:1". offset="0.50796592" />. <stop. id="stop2423". style="stop-color:#b0935b;stop-opacity:1". offset="0.74009573" />. <stop. id="stop2415". style="stop-color:#fcebbf;stop-opacity:1". offset="1" />. </linearGradient>

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\mail_icon.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 65 x 54, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):4548
                                        Entropy (8bit):7.940902601053362
                                        Encrypted:false
                                        SSDEEP:96:B6MC1mfxQGFRS5VXbT/yeTEd0YaUnPj0WZqbvYm5WkK/cm:BaomgRSfbTdQdnNPjCLN5WD//
                                        MD5:AA97731F75066BCEDDE8077F4AD87430
                                        SHA1:7340910D7E74C2FFDB1830358EE7BBA823057CBC
                                        SHA-256:D603B32D4C331092FE947B1D2E9AD43E7D701436B539DFADA6FFD85838DF8699
                                        SHA-512:77E793266A6F947C9C37C1BC278F03A63627D3B1E93D5025F1964858AB6D132DAC33E054B75E1210096DEBC29620546448722B9FEC46DBCB003E3A7386E5451C
                                        Malicious:false
                                        Preview:.PNG........IHDR...A...6........<...AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\menu_vertical.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):997
                                        Entropy (8bit):7.21865102763374
                                        Encrypted:false
                                        SSDEEP:12:6v/76q22Ox4+s32iWfG4yCDFRbRkUWoFulndZf+awOPvY2D0Vfk2IZv0Ake2Z7nx:V/Bs3wG43FP+Df+awO5D0VspZv0Ao7J7
                                        MD5:52379D1219B147DAD4EAB4DD3916BE89
                                        SHA1:068B1EAC1A6484C2C25D026917B94D4120E14565
                                        SHA-256:E6ECB30EE42657FF6449AE801B32599DE79BBAFC4227A6F1E6CEEAD690A1D672
                                        SHA-512:C6B96A9E9BD69DA68F89E4EA04785D2FEE574D278C120B0CEF1134E5E039B3CFAFB5DBA4354126817BACD45E6A776222775D0A70AF26B84FE97257B1040D2DBA
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....bKGD..............IDATx...AN*K....#.....2.G..6#..u...a..........PE../.i.*..4....................`...,..&.&.....^.ao8I].U.......,.,8.]......w=E.8!......P.d..U.W....J2/p.I.......$....$..r......K..M.Y..0..$.*f_T.....r..p...h...4..i.@....).MS....4M.h...4..i.@....).MS.....m*f.V.....b.{..IP......+fC..cQ.....Z.|......WX....9...K?..C_...?'k.....M._...m........................,..&.f.`...b..NR.d..;.......dtI.Sn8.S....J..[.EN.{....y..M..H..&.B.,.u.\..-....R.|.vV..L.&......'A......;..o....4M.h...4..i.@....).MS....4M.h...4..i.@....).x.....'A......^1{..`.u......X.....)_.."'..t.......$.EN....+<...W.'....'.K?.j..~3.u........................$.$.I..?.k;......%Y%..qG#..,8.]......%...R....C....5. c^.|../..I2..;Kr]!.~yK...n..8.......I.b.E..IP..~*...G....).MS....4M.h...4..i.@....).MS....4M.h...4..i.0.b.g..IP..>*f.W....o]1..b6$.;....`.e.......].q....:.y..........:......s..I.....d....{..;?.................0a..5...k.......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\menu_vertical_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5565
                                        Entropy (8bit):5.489309030569267
                                        Encrypted:false
                                        SSDEEP:96:5uURgCETmGA0Ok0IBEoPlat2DybcSwnLVpe3wLKpe3wLKpV:5uURgo0Ok+yIGy4Sw5gAGgAG/
                                        MD5:A9F45868EA789C17608B8AA7CFD0195F
                                        SHA1:D2F573015718D8A10C3C29E7041BF8215D312D34
                                        SHA-256:A492B9E638F5D68D304854B2D683B9B587427CFFDCCABAEB27EDAE7C4058760D
                                        SHA-512:E573D2FBE7848286DF6D959481164E94C4FE33EFCB2AAE0199B5579F883C1BB1105DD2D7F13C2F61BCD2D555927367E64B3E0CB97F5521EE008D32196E16E1A3
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....zTXtRaw profile type exif..x..Q..(.E.Y.,......`...f.s..O'...3_.*..,.E..I..._3..D.K.j^j).R..rC.3.U.W.R....dOw..$..|.r.....8...~..K.../}....(........A.@;.....u..q...?..E.g.....7....!$.J.?..x8IC.P. .(.(J.....wq.S.G3\.o.=Q.[..^ie...K..]..'.....3g.Z.l79.....x..>.....B].E=..Z..c......fx...rEv..0..w.N...&e..h..N..f>....e.].+w.~92M6....]`...Z...5.c.A...1.}..~..9.(.m~..~1G..F....@...T].~...\..5..G."..).+.{...-....3H6....S+.....j$J.6c6".....u..;..*.8.Y...sL.......s....H...9...X9+..e..j*.U...k.V...+q)6......Uk..]...{.V...M..Z.Zkk..A.....Z.y.=.....{.[...k/.....!...(..:.A....=.a...h.[mJ.y.,..:.M...-...].x...vS...!Aq.h0.0N.@...64...)g.r.l..S..'5...b ..b..`..$.....d....Wr)....wn...Ne..S.A....c.;..]..N...i....}.>B....G........_.?e.. bJ?....iCCPICC profile..x.}.=H.@.._SKE+"v.q.P.,..8J..`...Zu0....4$)...k........... ......"%./).......=...B..T.k.P5.H.cb6.*._.D/...(1SO..3.._.........9......H<.t.". ..t...aV...s.q..H..u..7.E....62.y.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\microphone.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):199
                                        Entropy (8bit):6.502673009329309
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPO6xshxyT1I3JQilfevL5xFVs9Q2lbp:6v/7Pxsh4a2FvLG1
                                        MD5:1986AFF717AF895B8B22B8E83A8DCD8E
                                        SHA1:1B085C4ACADDC63D6098DBAA2F10831F7275FA8B
                                        SHA-256:EF6C6AA285EB18667D992D916DCCF2337FBB98B07631DE8EFBCBEDC24958E347
                                        SHA-512:F5DF9E8616932B0F879046BBB2A8FA4E534EDC77E59D3A2B1058DA73C36AB20E126FCEC073034CC64414DD129D554B64FCA403E6F49096E29B63EFF015D3B3BE
                                        Malicious:false
                                        Preview:.PNG........IHDR...............7.....IDATx...i.A.... !5.... .......Cc....N.....@E..=&....O...AVU. .M.d.....*...@.T......n.....n...x.|zw.7~...f...jk.l.!..O...k..\.h.).<...%.._&....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\network.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3031
                                        Entropy (8bit):7.892998440069336
                                        Encrypted:false
                                        SSDEEP:48:UNpK7kK53XJ2tvzTuqKyRmuY5yQ8QdgLPclW5yUQobw3Ha+qpJ6jInqd4JihEEs:CkFpWvzCJuYk7QiDclWuVHapojthxs
                                        MD5:56802ED77DED3282C7E1133403AD809B
                                        SHA1:211F85B6B9476DE56709B542E2C8715BF2F3C16E
                                        SHA-256:42D7060EA7B16E9CF8FEFEF098A56A77616E595BADDB5DCD353242A1C07CEEEA
                                        SHA-512:FE10A020FD519501CF7EE9B7C7E36DDFFBDD1407B07D6AFB44D048AB3D30662BDE1884F248CB13983CE0D55622FC561431F9825DB1C03605E0663273EBE12036
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Computer...v....tEXtAuthor.Lapo Calamandrei..*....IDATh..kl..u....;..R$E.T..zP..n.$.%Q..Z@..q.......N..ua....}.h.~(....>.....N....T4..t[.p".1..RRG.dZ..Dr..3..~..KR........;;;{..<~...*......./`....-*..H.@....]>..@.{EC ...Cq.*....4..o..{....x..H....?q......0...w..c."..A.D.b..j......-...}<...|N.=>/..k..U.^....F>.\..F.aJU..j.n..........y..c..?M.jV.B.0A......B.8.s....w....<(..srf.U....P.H...gY..|..I....+#@.0...3..H.8..ZG..*..,42...X....P..E.....$)!\..1.a.l..h....i...<.r...3T.r.H..b.A!...%... .2.f....Y...%....kq"5&......Mr.....L...t)..F_....H.........}.6r...0FQ.Q.Y.....k.4(ij....c.l..|PE...0..F....h...".....}}QY.r|....<..9"..j.,..J{.Q..E..8...V.A,d.21q.......P.....%..Z.../.3kx.1..RN......|.......k.....8.l..x./<.K.i..J...F...W.,W.(...8.PT.V..).5...@.j4%.#....@...T.... .B...J...9 r.h.^I\.....%..*"...4...q...W........D...T.fDM...!?C.U.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\offline_tx.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):463
                                        Entropy (8bit):6.995233320421183
                                        Encrypted:false
                                        SSDEEP:12:6v/7kYiUpZhKeAAthzDyVmlmLVOqm2UKx34nRP7aW/GFQHN:UiUpqeAEZDyU8ROBz838P75dN
                                        MD5:51FB191EA358A072A69F92E4D5278D54
                                        SHA1:2A782A97B00C2BC64669AFE9FF45F0DCDB9B11B9
                                        SHA-256:81727605617F1CDF8A77D48BC554A080555730969CA261CB669560D295B4D65A
                                        SHA-512:B5BF8270536BBCDACD6C89C54ABFA88D0307FD4787638A06625AACF9F6E09A3F0A45F466F2F2062D0F15BA04132E4847A5C1FDF0AE36484802FA85DA76D078EA
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....LIDATh.c`...`d.Ft......a.....f..0...Z..\...d..`.m..C...10..4+.De.R....fR....|...J/h$.E8....X.o..<'.........F..@..<0.`4..4.....F..@.Q..4...@.!....(..W'..`......IIHK.6C..N.....u.=...P..v.6F....|......I1....AX...........r.E.$.02.C..2.B..4...u.!4x+...#...x....zr...?.C.es6....<p.*C...E<.bd`....@...c)$C.b.Ud.,i......`......2.L^...f....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\paste.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1309
                                        Entropy (8bit):7.792147582960006
                                        Encrypted:false
                                        SSDEEP:24:ygJEdhS85SSGg6Ay9BNVQLVt/6tw2YoZ5leNGR1+x1BOTlcti8imX4tQGIIgx4aL:hJCt53GJ1GLn/6tmoZ5leNGR14ulZhmX
                                        MD5:04BD3B83FFC3260171E9A6116DB5CB8E
                                        SHA1:EADA3DA9D6BA77A991A4BC14D8079C315C655F21
                                        SHA-256:64A811C29845A9B15BD87D8C1751ED55D075548F5F62852BF21602248DD8EF8A
                                        SHA-512:A1C24D6D3918A1F215271239880AE1D220E7DD69A5C75648BA711D2CE82707AD07AAB9F0C2F34F68CA46E46E7644115C7E4CA248165AABC009590C2F30B1F8C8
                                        Malicious:false
                                        Preview:.PNG........IHDR...0...0.....W......oiCCPicc..(.u.;K.A..?.E.A.-D,.P.0...Rca.D...f..$B....Dl.....h...h+.*..".X..|5..;.. q...qf.e....y....`yNr2../,j./..B3..t.....;>.S.6.z....hI...uM.#..x.c.5.V.-.a......#...Rz*.g....;......Z..SUl.p.pO!_4~.n.jZs3R.dv.d.8.)....#*..j.b?.)V.c..f.G.Yr....(]M...M......f....qhx...^h.r....|.|..G..*.U.i.C.RE.9..&.]V....oA.;......d............~.9....y.k..>..Y....h....Q....pHYs................TIDATh..Y;o.A....m..%...H..d..h...H....."$*J(....D....D.@TP .!B(...B...'...|9.w...rWxg......=.e......y)%...+...S...-@.b.}...l..@.q.......q~.N...@..@.I.b.D....hs3.KQ1c;fbDrcc...C..?..$........Z...p.....['..z...JB\#.&..A_.5....oa.U......*..e...,..iuu.U*5%.`j.....MN.I.t..o.s....0{S......Jr..c.K.c.~..J.c....v.. ...=X.......H..`l>M1.3vX6...2j0..j..r.8~.S.6.w..6...8.[lt........90.P.9....|.6....E=.....@.<..C..x7m...h6wY....P}.6ph./.i..L../...|(;.{.|.P.......9Z......c.N...m..E.^..t..o...l!...8@)D$pT.\H.;.@.v..;.....Er...id.B...U.~h.Uh..g...C.z.b...C

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\pen.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 127 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):5625
                                        Entropy (8bit):7.863385035645726
                                        Encrypted:false
                                        SSDEEP:96:ftQcpmstcPvvR0gTRowipcQJGWoCxQJOQJHVLPZoonkswWHc9:FftcXmkFoG2VexPm5swUy
                                        MD5:239AB6E6F6A28BBCB05D713E045BD0AE
                                        SHA1:44D5F007F7EF15F5A7394E893BED9A69920CAB1C
                                        SHA-256:67F080F04A2248CE33741987DCB836AA5B99FFF9F93CCFB2F1A7DB54DE45DB31
                                        SHA-512:BB9FF9BEF96D3FEF1746AAB73F9AD48612E1523CFCE805135A146E5CBEFA45386A3F1ADDCFFD5ABD83B5A1630A596F572D5DBDB5628CF327A5F759142932ED1C
                                        Malicious:false
                                        Preview:.PNG........IHDR............."y......gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.........O4....IDATx..it\.y..........,.@H[l..S..$e.B.r.!ml..h.n......R.....$.9m..&m.f9.4.I...v...<.l#..I#/.f}..+....W3......;.......W....1MP..Y...n.n.V.W.M..$.1`.8....9pB..S...<.....QK..&.g~5...}..4p.............../.$.<...?O.~....a..J...g.{...a./;...|....,P._d.M..R."7._B..@..b.x.xP)5h...=.n....f.M....|..:...?.F`=p....P..M]].D..X._$.u..........X.l......'.Z.c.lo../.2...-.T....@....qS6/.nV..!........u..V.i........W.Ge`.}>...h..i......".."..S#\..,".....Y....._...4.R.....<.n..B.X....K.p.;...MM4....A2.b<.......$22.X,..#l.-;....O.92c%...@.5M.@.8......a.*.b..[Z..F.k..$...H......i'...-.`.?.....3@=..@..I........r..u|`.jZ......>.`aS..Z..EMM.2.H......F*...0"7\V....R..I..8.......Y.pa^.......,...V.E.L.......V.U..#.;:..P.?.m....o)............q@.gIK.[...tz..7....H.......c(..<h..T.c.(.~?+\.......q,.e<......x.8..w....zB!....N.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\picture_in_picture.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1519
                                        Entropy (8bit):7.346859617844218
                                        Encrypted:false
                                        SSDEEP:24:Vv8FhMrsQe5h9j9GjW2FT/0FEPOcahAAAAAsnAAAAAAAngWFvIRYmmUlkBOXc4J:OFhMa5h9j9oPt0FEPOcuwgAFmDkBKc+
                                        MD5:A237060CE839D930C5BC4C31B929F5E4
                                        SHA1:5F999A8B7E54E606D9F12DA7D9BC3210EF1B299E
                                        SHA-256:7B28A4E860A10C693B44D9B7E12E8A45DF7F21139945308D04291CF12C4030E6
                                        SHA-512:4A1EF9180C35422A7AFC1AD24215D6ED1F35D0602C97E4AC5677167F4D8F4B465D5A5E75CB7CEB4AB5A505679FE90077B88D5286F2DA271685F2987A367D603B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.l.....bKGD..............IDATx....k.u.....{.......B.."..0.J...h.F.d7....A.B.C..u.T.iPH.r...)....MH,.......9..r..........9.......}7................W/......[.F++e..d.j.<....8`*...A....Oy....Ff.ZW....}~.il..6K.W.'<..F$...;.cM;W.n...i...._/.l..E..3..4.I..zu.......N...._...Hj...@1N...[.z.....-.U_..S...(..5V-m].a.<:..G|^...[RwC..../.7<...L>...>:.m-#.O%.*d.P.ojmy.v...3.....:RyO.....]......}.(....v.....(............>.udi)+......v...{I.Q....T*..'?.}s.J/..0I.{b.N.......V..,m>..;@M...@J.m.$......&.....HK...V;..x.V..L.@.%@...wf&.H=.HdE&yG..@.v[&..3.4|A&~.F\.3M....$..Gh........Dr..OgN.S..<.qyC_......?........it.|........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B.S..d..whl..z...@.n.in....o.... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\preferences.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):58005
                                        Entropy (8bit):7.981001133922237
                                        Encrypted:false
                                        SSDEEP:1536:+PxrzHqcm39TBsFQNUX7TYIUh3lD5mIuh8/f9kH:+Ph2cm39dQQNUYIUB9BVFo
                                        MD5:0BDE10EBD19F36D720C2AC4CB23C75BE
                                        SHA1:F8D92A3FFC02D6B655021E7366E1E4343CD2E4ED
                                        SHA-256:D3D4163A8D6788F78D2C2AC56E261FE506F4915065EC488F79F858C7CA13C2EB
                                        SHA-512:844CF68A308B5A3A755714249D7E1A4F65264114EB2BD5BBBE8C190393E25E799A39982BB1F1EE1CBD2F7D1E351F16E6A2088AB2F6387D17FF3BFD8CB974C120
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.....NUu.I..(K......P........w.w...z.B.wg..!.k_s7\.]{.7|..i..A..l.ec0A(..&..X.............k...NUuuO..y.s.......`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`..2.'..-O>.d$.J%.!M.....$)..@$..}...N.92.....x..|%&..*.....R..`).e...h......+.......tS.>..>..c..!*...|....~....1.a..Cv...@.....=..w........t...8@...%.....;v.....`0.3.&.:...S.F.K.O..b+......+.@.....@...........c:..<Et>....n.p..M.....|r...'.....~C..S}B...1.`..D:;;..X.&..;Aq3..T.S.8......a..v.v.O..`0..L....]..R".9.;0."]..B)..|L....u.M..0..F...<...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\preferences.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):27175
                                        Entropy (8bit):4.978296915866158
                                        Encrypted:false
                                        SSDEEP:384:MxltEaE11Es9O5cuzJxb2GRbz5nKbTqggjNRnx6Vhr9SC4cudg:Mxlt69CX7bDdz5nKbOgsHxu9SC4vdg
                                        MD5:5AE87DA02D4994C81EBED270CD45405E
                                        SHA1:47BBB94DE7DB651BEF731D915336254ECEAE9085
                                        SHA-256:8310F15BB417931A99FEA8EC0ABA6437C422A007BBDDE088ACEFF605718AA854
                                        SHA-512:A0B849E22842F931F0C4998B36F353951264857927BB17DC894991AF88BB05271DE623F75E054481BEDE80048DBC21EB224AE7951319D40E313192FD7B9CF755
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:ns="http://creativecommons.org/ns#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="512px". height="512px". id="svg4289". sodipodi:version="0.32". inkscape:version="0.45". sodipodi:docbase="https://commons.wikimedia.org/wiki/File:Gnome-preferences-system.svg". sodipodi:docname="preferences-system.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape".. viewBox="0 0 48 48">. <defs. id="defs4291">. <linearGradient. inkscape:collect="always". id="linearGr

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\qrcode.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):314
                                        Entropy (8bit):6.8331753934323185
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPVjnDsp5BAAAl0hy2YxsDEIyFtKgcOsxq0j9/Iov5Fgo4G8up:6v/72RAAANmDlyXKSsxqigyngo4o
                                        MD5:5B142F2315C1878A0A13E5B0112CF477
                                        SHA1:44FF82A1B89C623EF19F4CE6DC51BA5916F8953C
                                        SHA-256:874D11BE3C20F635845464AD2E4FD1866D1CCFA3793E51C6BB0466433409A75D
                                        SHA-512:593793B1ADB885C025FFB5D675B9B290C961D6F542E87BDCEF3A6E7B28372D45E55A63A081281FE4477E6F180F3758ACE67D1BEE0F5300B563351B8DBFF50FA9
                                        Malicious:false
                                        Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.%...@t#.k.....,l..... .@x..F.."..g....7..............a..X..$.O.,.q..P......vC12{7T#3.8&...}H4>.>4...hQ...B16>....Q,..b{$..P1.....'.l>I$..DV(}........h4..Fs.m<l.. ..... ~.%.@b.Hr...@..JE.@.....@.. ....;.".......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\qrcode_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):7.010361133917859
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPv19s/6Tp0jt2jsNcgzwHunoxxrBd9AYQOYuBSE8lGEUHZo8l/jp:6v/7js/6Tp0jmPgcZJd9pQOTBildsH
                                        MD5:80AE0CB6EC943BBD3ABFF1EB25DF4AFF
                                        SHA1:1BE471FECA3CF83842034E07F419FBD8A62EFB8C
                                        SHA-256:BF6ED6E043082EFAD7B047B7743FC554DE765BE504E2F949F326AE1418C40706
                                        SHA-512:F9768E970731B736AB9BBFCB912E0D692DAA95939C26E416B2B754B2D9A375ACF8DAD7472A22FA723E9CC3E6E24AF1AE21392F1FCA8FCC608812B374D025F686
                                        Malicious:false
                                        Preview:.PNG........IHDR................a....bKGD..............pHYs.................tIME.....6..}L.....IDAT8.S1N.A....It.i....HA.DC..x..?..D EBJ."M:*...4c..".JV VZ.m.k.."..9ff....<;H.Jzly:.$.afp.'3C.Ug....d..@.s........H......,i..H..u/....%...W.5....<....o.{<......W.:.+...u...9...&9O.c.........i*U.Y...m..%y.......u...1"..."b..!".fvZ}.G...;........,.._$....K.O....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\question.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2555
                                        Entropy (8bit):7.903707300768179
                                        Encrypted:false
                                        SSDEEP:48:SGVuz+yQjPAlzgOkNeRYpi5Utb3deYhwQBySsRfC36iVMCekiFfeq9p46HuP+q2:RTyQzvOkQ+rtkBQBySlqiVPe+q9oe
                                        MD5:AA64EE12B7213AA1FAF0177F513248A7
                                        SHA1:560838B563379CEDBFEEDB38A8B234E67CB9D0A6
                                        SHA-256:7131F304F5152243660964A0B97912E13264E8B2E8BECBABF58ECE964F6D06CE
                                        SHA-512:515E66DB60166BE9A4883C2AD734F5EE1DE187A1A2087FFB03D9D0E619012E289B4C91B27B90C889E976D20502C6CDB85C10EC889EA63532790356E6CBF0DA17
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...2......?.....piCCPicc..(.u..K.@..m..t.A.!C..V..8j...)..U..B..K..W... ..k.?.UpU..E.qs.."%.k.-.py......w.?.3..I....l*)....;|.C.SH...2.4...#US<.E..u.c........2.;....-...G<.Jr...8...BW<~.\..K0.e....)..XicV...$q..+.y.q..j.,S..5..Y......lB..8e.f..h..P&....*89.(.7Fj....5.U.tT......f...$....@p...\...u.g@...6[.2.i..ZK.......)....0.l.\nH.Z~M.>..p......Y5.q......#`..#....h.c.......pHYs...M...M..9`c...1IDAThC.Zkl.U.>wf...n..].Ph.)Ry.Pjb0Z...|.S...6Q.....$...?CH...)H...@).6..PyH.....v..3.z.....mwg...Rv..{.9.|..s.`..YH.[._..Qi...DBj.......F.(.^..(.s..j.{..7...C.k(..D.^..[&.Dq9...+.n.Z.."..Fd....|.P...Z)e. .w(.?.....x..(c@.#[[.oGK>AC..NGxYY..p...r.@..\..%..)...........T'...m...@...T.@Z.w...|...+/.5...|4.x.~.;.<....H..L~...O_.Dg.@....bwd.'.._\.V.V-....2Yk.k.. \.y722..)....{...s.2.xAZ@.;p..n%.....W..,-.OG..k.....?...e......gF.S6/..?.\a...nwvi.*.#.6....{ ....$./8$........K.@^8|n%2..|w....(..bd.Jd..........~...?.)....T&........H..:/].2.."

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\revealer.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):272
                                        Entropy (8bit):6.2770460901246015
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPgNQV9Bm4dKcXtrX4C6MaAJoSYMHrSkPtWGiKp:6v/742LZZX4CnKMHtPtfj
                                        MD5:EB80AEDF5B34DA55D8374BD64C31388A
                                        SHA1:657C580521EDA2F1950AE2759CB282E802A5726E
                                        SHA-256:F71D617A02018D8C805A7E60FD297CA1C133D83C95FD52FBD557DE4BEB337297
                                        SHA-512:313B215288B72B9E75F71B0F21BCA4C64611DAF2AB7E8C1B42E3C36FFDA78981C5D88695285DB4CBD4304E2720947DBBFAD001E2BEBA7392774D238E846CC1DC
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<.....:..r....sBIT....|.d.....pHYs......... ..|....tEXtSoftware.www.inkscape.org..<.....IDATh.....0.....5.l..1..V.5l.....}.<r.]j.[...7.....5....3..`:....3..`:..j.....\Y.1.....3..`:....3..`:......i...U.{.].`:....3..`:....3..`...b.8.. K....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\revealer_c.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 510 x 510, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1965
                                        Entropy (8bit):4.837695335858453
                                        Encrypted:false
                                        SSDEEP:12:6v/7PtPyHAxS7jTGECKFOFOtnFOF7FOFOtnFOF7FOFOFAFOFNe4FOFOFAFOFNe4d:KyHAxwvGMeee0MGSqeeeGZtaeeeCa
                                        MD5:6546779DBC25E0DFB2F935BF96BC5024
                                        SHA1:C0CC2CEAB6FC52683A7460C365D0B5E42B24AE03
                                        SHA-256:E5402C2963B446F93E667631C3777CEE9CA14EB60D8943C83EFC6707DBAD73BB
                                        SHA-512:33D7BE6D78BCE54FA6454E6DAC33A6B1ADA26E29D299BF159EA3064D8405AA6B6BF9E4483BE1AC95E0E6798E51216A9E1653561DA546BC31B0A1C0F0836E5F9A
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}ol%....bKGD..............pHYs.........B(.x....tIME.....-.#.b....:IDATx...m.P.......A........#.....;/....RP..oFp$K.s8g....t.......7..........?. ..........?. ..........?..?. ..........?. ..........?. .............?. ..........?. ..........?..?. ..........?. ..........?. .............?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?...j...a.RD..&Z.VF.Y....j.&]..C.D..9.N'C........~.@..........~.@..........~.@..@..........~.@..........~.@.............~.@..........~.@..........~.@..@..........~.@..........~.@.............~.@..........~.@..........~.@.............~.@..........~.@..........~..~.@..........~.@..........~.@.............~.@..........~.@..........~..~.@..........~.@..........~.@.......7...?. .....&....H}...p..1..Q....3....n.[j......w#,@e..........?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?. .........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\rocket.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3869
                                        Entropy (8bit):7.9449346827433525
                                        Encrypted:false
                                        SSDEEP:48:+aPMsUHEPMD+P2oaKky+FAVNoFwA9ZZ8kOF+2wZGifY4egixgAkJcNQ0tqkX0:Gske75uyMiAXZiFMzfYgirnNQeq+0
                                        MD5:E23FA5FEBCA81A2F9D4C131F7E9F5120
                                        SHA1:7F4C2A9604A5A3E800E7757DB91178B8FC6ECFE8
                                        SHA-256:F8EE64F59312C356D1EEB4164F746646398FD5F8555DD30A9A3744725C136891
                                        SHA-512:1EDA81A435CC2BF4AD358B27A50B4CFA241FBAD7F307792B34E64491FB26464FD015EE672201F2B58A590501F789F403BD4152367D20F60AD083DF65C0FAFD93
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....pHYs...........2.....tEXtSoftware.www.inkscape.org..<.....IDATx..y...u.?...;..."......QRA.Qh..jLj.4..JQ.hc.U5iWC....f....&..Wl..:.T...C..E...".S|...M..\.p.7#......g....}..g..PJ.........Kd..s...M.01.m.k......>.l...."..V..O.hm..Hvj........~D.s.`..|...'G....-....w..BQ.P.-.&..d....i.^ln....&d....Ig..........I.@R..s.....?..l.+b.........?m.8.{>.....$t..,.)...Q.H+..."...f+..n2.v.p2@[g...).6.....d.......q. ..T,..3C........)..........46A.ki......$!Y.(!..}..'..o7... B\^%..P."..!.).R.{.J:.F.+k.HP.:l..:g......l.{.&./...2M.E".......-.]I..UyBGQ..@.~?..I..m..[..X!.UKn...H.!j;y4d1.>./]Y.......@...*...lzg..h.@]P%..p0H(..WG.`...q=Xq...O....(.TI......'R*.eg.\..9`r.LJI<.A7.......l...........?!..W....c3..c..=.....S....x.`..2u:/.3.......7.]....7v4-E.W......A<.C....G:..-I.X$0k6._w=...K>.1..... $..V.,......0L.C3.B....q.<.@.J)2.,c.Qf.6.w4.i.W..n.|T..c.yJ.u.0>......R....5.L...(.....~....x.OG*K..d..=......k.P...>......B..E.R.vk...t.Q

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\safe-t.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3871
                                        Entropy (8bit):7.925259657332706
                                        Encrypted:false
                                        SSDEEP:96:rnh7N8ANZJlsMQmLrEiZyBnxhvQBC/GvoewBQ+afUF:rhRPhDA6LyDF
                                        MD5:EB70FC4885507159B615F8D8F2DF5234
                                        SHA1:63A3FED99DB4CE9AC40B2C49E1FC4A1084754686
                                        SHA-256:F614054FC285C49271D6821040EA7612C5E604B7A4AC64C158B3B08BF202BABB
                                        SHA-512:1620D2E147A7FE46ECE0A565605F2C0C10964BCE4652D4D97A1F1DF11BA69C210D72177FB9BC806C1F6AF49BB3BF2E44CD3A25AD451A41E8E6C1E7C02EFDBE59
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sBIT....|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(......Y......1....H...:.C2...kIDATx..yTU..?...*.."..dr.A...c..C4..;.5).V....k.....}...4y.Q.D....C.h........ L..Q...+...~.\.p.>..;...u......_..g....#..H)..^m.@.......>-.-.....=...JgR..@.0.H.F..@......j.....%B.:...~.PJ...m.............q.D..f..X...R...@.0.{.J..{[..9.......Q!.eo+.H@)..`...L.....@....'..-.....M`.'.u....[.h...l %..V.D."@...@.)..^........+..$.X..In.(....Gw..c.Z)/+......,f3.5........V].C....Cll,.I.$..I.$...=m../..`X@).8...!.^.@II._..RZRJqq1g.q.m.1x.`F..MrJ.....=..hwz.[=............/*......J,f3...444..........O.$...ILH$}B:....;.......(....s.o..U+.....H5=..........<..dr,~Z..z...lG..|..r.?.x.6...oob......F.1*`...M.......*.....q.,((0.Gs..E,.....R..F..tu@[E.;.,.....n.'...%55.S......S..R..WQA.qqq..,......4..EE.Z..C""X...wN...n.X........gaA!........[..5r.g8.N.7<.t...p..... ........l..a.........5-.G/.X..y".F......%

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\safe-t_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3719
                                        Entropy (8bit):7.922465789444943
                                        Encrypted:false
                                        SSDEEP:96:mbw1zNchE96p0vyZQG8ILP/fy51iRlEKT:sw1H0pVzz67iRSKT
                                        MD5:83C26D946771AA895638259920FB2FCA
                                        SHA1:D36154772AF449A2038AE412B08B42F8E8D3A20E
                                        SHA-256:14ABF48D20B24205713A709BCC1946F2F94F3070320AD1D50848D06EB8F136B2
                                        SHA-512:AFC2196C49438A131B7D797A94462E052B9B633A654EFBB1B54ED6AE179837B4F2D2A5A198E8695222D618E18C462505A1579D99D36E034488B1E1A0D2F694F3
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............sBIT....|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(......Y......1....H...:.C2....IDATx..{tU..?;7 TX.a.`..x$....$.....)..3.X.:...Cy.3.......5.*...V..|..........`.7DI.KH&.q..o.8........]..>.q.w.}....>.~..D..:?...P..vt...W..J)w..'.7+..a@&p3....R.....+P..).>.*.RM.i.=.&.....t~n.n.F...n.....g......-....r...x.^.......S..S+...a...`..H@.......`..|...O+...).o.E.>.@L .Z.I{{;.W...v.v.A.wG..*...... ..I.H"##....U.]...Z.o&........[I....TUVQ]]EMu5..:.N6...DGG._eE....HRR.i.i...K..t....m....4.2..PDn...mq...***....NT.....S_}.O....n`...ddf.......IHL.........0.....r.....Jjkjp..Q]UMKK....A.HNI!}L:.ii...........TJ].S.-.Ed2p..}.6.y../.)._.p8x....UO=....L~R)...r...|O..bV.b..x.n...onb...g.-..y..-.6.._....M...{`II..:.5g...ry..+"c...uAgA#..\..../.nd $.Nb..8"...\.?v...K].%%$''{..*_y}....EGKK.,.bbcy.g.}..v....X.....:.%N....<...F_y.........Ett4;v.4......[.C^....6N.v8.5..#.......k....Q........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\save.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):946
                                        Entropy (8bit):7.238902576094043
                                        Encrypted:false
                                        SSDEEP:12:6v/7StqB047Xy5ee5y5ZKSt5mpDef6WSvZtzy+/oQGfoRAs93BAGyjlv8WcY3kz6:zqBpb2X5yz5yzzF/30oRAs9R7olvxcGF
                                        MD5:524B4AE79599E80D26B065337966BEA7
                                        SHA1:3D09102D8DD55404EAFD48EBBC36AFF16E40CD6F
                                        SHA-256:91361F9D7BBA7B184E3F9500DAE1DB28771FB0A1B4EBF2B92A63268311A1D2FA
                                        SHA-512:6A9C7CF5AD5C6D5550DB2B793A32A818240FC51207F07EDF717BBC9CE775DCFDB157EDC9D662E016280C2C4F015876ED4E38D460B6B7F6DE685394BE2D1C42DB
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....bKGD..............pHYs..D$..D$.@g.T....tIME.....0-I.....?IDATx...;O.a....E...lD........VV..++:..Qk.l..ha.((..RI01...a.....X0.j@f.7.s..F.........(...............".......%]c.%IW%."b....^...nI..;.q.vD......I.......#.....W.i~S$..5..wI..X..[.{.dw.N .Z....E.O.X.F3.pv7..wm........2..R.....>.....q...{.i&..W#b.?...".z...M..R.../........{..^..[e-r...s..JY....n...8+ ..-.!.T.=..E...@...~e{....ND..q( .z...+6..Sd.|.=I..5)i..Z|(P.g...........@. ............@..k..?....k.....?P....~gP....tE.^..,i{U..C.H6.*...H.&i.....~..."..{....o%m.l.{...:....U..->...@....................>.W..%]...VN...YM..........h....s.^E5.a..0.....%.S..r.....,0....-i.M...3.j........@. ............@. ............@. ............@. ........@..X.y.).l..l/....P....bW.m.:..{..^.....s,b....lwZ<.N..=9.b.!.Z.u....{....$i.e..!i...8v.R^....&$.rtO....Z..DD/.u....R...2.2..JZVS..[.uI.#b...................C....>0.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\script.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2911
                                        Entropy (8bit):7.81621123142847
                                        Encrypted:false
                                        SSDEEP:48:Jwv4jhZueRoLGg//fTyySWNbTLumO62ZZ3mykhWPGbaDNIcBBvGFmL20Fph:Q4jhbGGgXrywbpO62eFENIcPeFC2w
                                        MD5:E4EB569930024777ADF71335659D9628
                                        SHA1:0887FFF664052DBF5C249348C3F6B1C50B975D33
                                        SHA-256:B1A056AF1AB081946509AA01247AF17188A83950B60FA7C60C6C1DAAE7F95FEC
                                        SHA-512:9B770EB23EDAB751D64B861DFE604F279BA40D79661D20A93FFD14CB0DD02BF785FE3865E2EDF89D209FDADD83A6D5C85F75B6BB5285C3A08A5F09661927643E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..m..E....lBr;..P.T$...E..R..%..Z%x.%...=.p.."RV....J.j...6........K.P.BI).A..Q.).Q.!;w!...Y...7.;....q.3.L2......%..a.....K..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s.........f.*.....u..j.u.0...$.%Dt..8...=.w.!..l6....p*.MQ..=..s.(...`3....... ..1.....T*}......1.%..=.a....~/-&.m.z.......A.|..?+.N..|.......$I......*............0..y./0......~n..!.V.5..........$I.-.."^.E..<..&.m.A.6.o.....|.R.l..9ELI.l...y..E.0....P.?.p..U...=.......e....yr../.v...j.3..(..AD.V.\....g|..8./.......[.B.././......em.p.$f..q...,k.*..?.$.r.....|.m.Wg]73.....l....!78..%.z.".Je.eY...Q... .>.e....m.k..R...q......\.?@D.R.....j..Y..D.(.F.o,[..e.M./=...JDw(.#......E......'2.P.3..\.?.o..h4....L..b..w.......K.$...Dq...........^.+.<.8.......Y.!.MOOo.p..o.........O1....e93.\....F........j...q.g..EG..).I.l......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\script_white.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2910
                                        Entropy (8bit):7.78162310769412
                                        Encrypted:false
                                        SSDEEP:48:Jddoic87FE78T0Vcv45kqsqYbzPSouIPH0xtychu23202ga3MXhnXGGGGGGGGGG1:TacqQ0ev45HWBxPH0xcq53/2N3WGGGGH
                                        MD5:F4C51EA252273896904B5E517D45B6F4
                                        SHA1:385D5C9AF9DDB7D41E679F9644852461B41DF088
                                        SHA-256:81D7844BB8753850E1CDF997D5DF6EB042842DC56588495CF9837F73361059DD
                                        SHA-512:5FB851442B88AD77A69E63DB4B89AE65860104022B0921D9D075C24DC74C31B0D2961750F5A569F6E49409CF8807F4D577C77CF6200D84C7BD0529F6ACF7CA4E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..m..E...o..BH.d7..._..(._.T...P......).0+&.AYg.....KH. ..G...1!p'~....-....._.5.B.v/(1$.;..~..*9...ef.K...<3.L2...t...V.^.......,o-6..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..3.]F.7n<iddd..K.....vyOu. X....'...u..vy... .C122...:...._JyQ;..:}}}.....y...`G.X.H.....r....7 "....S.!.M..C..R.../l....R..9.!....4..c.J.R..0L%m.h....{.h;.M...H.{.....R.?i... .<.....MsJ.::S.f....... X...b. .{....<..lN.{:.y.."r42......I.'..)e...4...We..J...t:...vi.B....6.O.;...Ap..m....y.u.....t&...........3....a..j.X...."......n.<..8=... 8..Z...9eI.\.-n...........#Jg.............h...(....B.sqz...r.....4....-.ut,G.8.SD.5.,... ...._,..R.d.[4.J.j....q..p.F>.....s..j9....g..w4.a!.R...[.1.L&.../4.9.T*.........R....z.DtS...]+....f..\..%.)..A..V}..@.......giN...8.m....;$....!.)w....[.h:.CCC=.t.?.d2....H..4..;.yw.X|{..7..).

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\seal.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):38276
                                        Entropy (8bit):7.932151176253116
                                        Encrypted:false
                                        SSDEEP:768:xAR8qtQJNd6ZMn8JykOulKvxZw3JF3bNYdGknf7XeXcwuREyd+ESU3BshYDs:xEHinjkd0ZI9RyzcyMU3qhp
                                        MD5:52B3CA06916C9DFDB5982CC92DD2575D
                                        SHA1:F69222CF35B62643991CE7E994F43AB223B7C21B
                                        SHA-256:E01E904D8F0B7CFBCF645BE75A34658A96B3097C2051122F081ABF00CBD3B48A
                                        SHA-512:D7C57F4F83E6AC0167F86E09A3F2E4FC8FA3DCD6D299508944B60D28F7F09B4A78A70CEC05C112E03EF9AF879702BE6F62711A23F0F5EBD3891438B4F2BB2998
                                        Malicious:false
                                        Preview:.PNG........IHDR..............x.....KIDATx.....U..SV...&.ww..u.........+........S...-3e.e7..X.<.......{....;<.,....,...K.K.M=0.@R....x.......^..<....<.......+...br.......xT...b.#)7...x.............../....<.Qp..q...I......x..^.g..7.....l......2o.|L.........x...B....z.s...o.?......x....?($I.............W..0.....{..p....w....k...}........](.$&.}>!.?.<...a......3}...c.+!...V.h..o..]..H..|.C...xq.......8...........x..)y<.:.'.....U./..}.......e.H_..p.I.?...x....s.*.H.\J...;#.....,.U6.........U.}*.X...eO<.........}.Y.Ll...2..?....Azj v...XD....vgg...x...cx..={~......3M..h.>.......n..w.z..rzSS..).....+.....}....h..7......~, .z.B...<n...ZoL.\.....+..n..o...K..........ju.E--_.....+L.....b...... ^. .p....<.q.'X..7..F.Q_cB...[UU3=.....{.....vu.};...}.._...bq...@OU<....q....~...G!ODzj.......H.....<.q.w..zM...i........j..;.O.fNC.F^.O3d.=.......{;.......G...p...u.?.....@.....8.._.......W*{eb..j4.....k.....FP..b.................0...0.A.M

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\seed.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):10322
                                        Entropy (8bit):7.961641798240323
                                        Encrypted:false
                                        SSDEEP:192:NXiG2KoPuBCiEtvo540UOYCgiaUMk+8qLrDXYDjyvluIn5g:NX724vUvoUOajUMprsCD5g
                                        MD5:B49187017DA350C42910561B3929BDF4
                                        SHA1:519ADF378A91AC0F05577492DD86A9E6D6863765
                                        SHA-256:E7020A4EEC65ABFF62B0884B0BEA7102CB2AE4A1FB619231A2E4E8BB910F57AE
                                        SHA-512:EFF1E0B3089EC88FA8A08087928C3315481238BA841DE69580FCD12368F60CC2FE2817C8171467367828CD02CFA8C6F7E6D6DCF7EB8635B453BFDC956724E8AA
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....bKGD..............pHYs...H...H.F.k>....vpAg.........0.1...'{IDATx..y.]U..g...;.[uk....@&HBH@..S....n....El..t...OQ......C...M#"...q@Q.. ...$...*R.x...s..c... .JU..|.'.3..{...Z{m.mN'$I:...@}.'..UU.....O..(......Nw..B....".....K}..9.7...:.......,.D....a.l.P.B".z..".q.../....)..#.w|*.s P.{.w~..E.d...t...}.r.....u....Pn.B./C..o\xy...x....{....Sm..q.J.....A'.&W.N......e.B.z&...1.4.......v.)..1.$).e^0.*`!.@z..=....?v....We./.....N.;|...t..?.|..%.y....h.D,..H.L..L..........x..........f.9....P....K..~..I6U.....h.2.E.ab.L.9..1..s|~....e.B........k.o.=qd....... C...R=...@.C....p.....6.:0k..E.t. .-...3.D.%B....B..Y.h.6.}I.3..%.{.M......s6.8.U..(..-~...+.o....t..fzO.e..?.....dR.2)...bm..px.8..........C....vkD..4..Q..*.)rx...x..W?6.v2."F..s@......^.../+.r..^w..........+'N..9z .........&.<..o..>|k...zs7.....g....x....<.dC.X......V..H.{Kc.....z.x....{.{o....q ..H.......R..M..\....E[...r.....9s...,G....l<{x....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\share.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):3325
                                        Entropy (8bit):7.887613741553613
                                        Encrypted:false
                                        SSDEEP:96:oSu44NQ3mHvwJg/FhWLmNJdzL+2ZZqoCHOBY:oSuThHR/FUmNfPxZZpyb
                                        MD5:B285C32910F8F429E718E8781862478A
                                        SHA1:182CCD2CDBED505316EEB79B33D05B79AA032F1A
                                        SHA-256:A8BC2EFF5BFD5A8863738A09727D8D62AFEF8C354BFA51E1D669CBE70F21A182
                                        SHA-512:DBA28ACD787945E94DAE86A5ADE215993BF531D47CCB200C42F12FBE44CABAA1B7152B38F1B0415952D661BA3801680B551BFA5C1E9758948778565E1FFFE38A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a.....bKGD..............pHYs.................tIME.....).P..m....IDATx..{X.U..g.n..~...."xI@......j...Y.<.c..].r.is...6}..L3/)x.T$.L@.......3\.f`ng.(wm..3...._..........;.<..D0,...g.y.4X...&.a.X8L.&....`.0...&....`.0...&....S.{l.....@G.' ...<.|`gm.....J.......l.A...D.V.<6.~............iQ..h.<....m....x.~2..1.L.+......OMx.WW.P..u .x#....&.....-~e.....1..[\..[O|D.9..l..!..a....9O>.L.....>...n.L.#..-....pw...1.|..:mC.......p.s........9..>.>......Af...._o...Cj....0......z?..E.w..L.....I..rlk+.,L|.U.C2!<.z..3......@.P..0..F.6....05.w....W...#..5x....A.a......O.../|].).@...4.X.}.Y..7...F.K.G..@......#L.}cg#0.X...2..0.X......H...F..D....9.CL...L...+....W.....;\.U......@.T.....q.S.20......PS....r....Su..j.....-.......I.O..Gc[.a.h...%H.&.T..@M..Y....-7..H...\..p.f?....&.FW|..8.Uk..u6b{.FNV..-+..&{........+.......@G.M..."I.;Wm......tN.bL..0H.W....W.Z......_...v....%H..l...:.W....e....rz....vq.*d.wv+.U. *.......|..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\speaker.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 16 x 14, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):392
                                        Entropy (8bit):7.094128145339606
                                        Encrypted:false
                                        SSDEEP:12:6v/755vlvZUUBtLVLtpAHYqfr1YRozObbf/6gU:65vBCU5pDR0ebf/g
                                        MD5:5E2F1E05870F10236CA49F7779146651
                                        SHA1:53368F74DDE769486680C05737D699F4279716D1
                                        SHA-256:E5E86CB035D56CCEBB94B895EC863C5B6C89001973962EF3A2D3FC9B14D740F0
                                        SHA-512:004047CBC4DEE63974060AC8EC1F9C18D0F6187C2F2F6D17EC765F84F3CCF56CE6C1BB8C4927247A9725D11CCD3FD8D967FDFBEAD84AAE72EF2960D5206290F9
                                        Malicious:false
                                        Preview:.PNG........IHDR.............&/......sBIT....|.d.....pHYs...%...%...z.....tEXtSoftware.www.inkscape.org..<.....IDAT(....+.Q.....R..4...VIY.&+..........feca..-...)%%.U~...+.k.)3.2..Y.s...=OD...B...J....-*....p......<O;.\[}..Xji.!.`..Y;..F0..n.w.,RJ.)..+.#b%"..b..).FJ.7".8.F.:&........!g....T.|..,ED.a..Y..tQn.._.&2K.R...v.4...G..&.J........f.k..k.&Hu.h.R.Q^...G.E.....?..E..d....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\spinner.gif

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GIF image data, version 89a, 128 x 128
                                        Category:dropped
                                        Size (bytes):15209
                                        Entropy (8bit):7.832309628792709
                                        Encrypted:false
                                        SSDEEP:384:loXLumk5i9IIS1fi1ekpslFzcdEeE2dOo+gFRiAVJlR7klRHRsW9:ixH2f1dkSFzcqbMOozFzMxs0
                                        MD5:6E58AD65334FEEB5E49BAC33334AB526
                                        SHA1:AFE8B6F09FA004BDC88A0D649D857D8E6A6D76F2
                                        SHA-256:CC4FB2AEBE634B741BF2616B811DD630E466A9A8930B9BBE10A281F9717DAC58
                                        SHA-512:EE8EC86152675AB2D126BDA46ED63674BDDD31835F084333696361BAA2E7B7C281FB2E7966A75711A72908F87F96F9230A334630AF31F485EC4B935EB95070F6
                                        Malicious:false
                                        Preview:GIF89a.......$&$......dbd...LJL...|~|464.........trt...,.,......TVT...ljl....<><.........,*,......dfd...TRT......<:<.........|z|...424......\Z\............................................................!..NETSCAPE2.0.....!.....-.,.............pH,...r.l:..T..\F....D....4-...g$ )Xo..sd.4.|^.:.2h..f...qp.o,tFvyxxzw......D.#n....D.w...y.'#..g%.....p.C....z.....M%*...B,....!...E.....u...w........su.z......*r.......$i..`^ ...).u..3w.E...`....jd..G...M.f.|.A%k.,..~.<" Q.I..(s.Z.+..3.>K5.T.H.Y)u......NW.(Z.'.I..i...LH.D`.:.....}...l?.d.....G...z\i.,.<...{.A.!s.\I....k....x.].5..IAI......M.E...(.[..:.M.L.:.k.D...K....3..U....i.=..w.....C.H..g.$ @.....N..<.....xG...u#..bH.\.....>/G....W.g..C.....A."@.......0...^U.^.. ..l .~.<8D...@.te..PqG.....NS...(...........o..."5.....-..."SI...I.X._.$h...M......a.#.%%....A.....I(!(c*.@e.NVD...)..].R..**...B.I......s.. .Q...(..DF.=.i...:L4.)..nJf.......&q..p(..Sj..Bql.D..".$..]..F.9....k.=......bp..O6;.q.*`..df...."

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_connected.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):71068
                                        Entropy (8bit):7.98934726992817
                                        Encrypted:false
                                        SSDEEP:1536:IE3lTv6JiUQhPsNVAAgkcjoDRjbnT5Zk6zWfJzV2YrDQiPnHL:J3lz6MPUlgkjjbnNVz0Z22DlPHL
                                        MD5:D0F584A62776ABB93DF85D8DA2D81843
                                        SHA1:94A10ECE353ADBC2B530A4758FDED9CE885CE0D7
                                        SHA-256:7AC930B1113B8A35B428909E2D6BB737C9DEE0CACAD5B1AACF4B36D48D1006C4
                                        SHA-512:C2002DB69265DE5E4E9890EAA8978BDBD59763A8E9837A38FC4893066B3CFD95CF65C9BC39B105C19CA0DDF8D85F9F4EE9B9A8F59B05A06ADBC580B8B3BD5698
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,.y..."2....y...a...&AR4.4.h.......fd.v.h.YiGgf.f....G..%....I;..).h.$..h.6H....}.....GUVeF..,s...2#.."2+~...`F3....p..*.....;N.u.B.w.....>A..bF3.......{"...8...?'...0.........&-.ft..L.3.......V.....E`...w..3...f.<..%).Z.@)..7i.N.uc.N...0.hF}.....g".l.@.C....FC.C@..h..;....4.hft?....$..~.....`...wF3..i6...^%.......2...3.N....V..m....4....KT.}f..C.C@.>3.....5..L.z`[.P.L._..h.>.........gt........hF>.F.33W......g4..`..V0.rg...=.u.=@.&-.f$....h..b...&-.N4....c..xFSF3.....tg4j....f.<.IR.t....3....xF...7.q..P..*...3.,1.......p.hl4..f4.......,.jF.I!z |.Y6....f.<.QRdb.CO..i~...y,W...U.e.........X........u)a./..:8.b.D.F........0`........!#.....a.{...c........M..m.....5....6...)...#..xv>.FB3...(....[.}....?.3.%.l......:.;K.z.Pv.P,....5X.=...,..b>y...M.E.:...u.e\o....> ..B....\3*.f.<.........M.Q^.{..\....*....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_connected.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):6593
                                        Entropy (8bit):5.024932699526309
                                        Encrypted:false
                                        SSDEEP:96:VkoIanLDh/IOKDYmT/35VYfLD++haM0c8XBrTo8eaABra2BS865MBR:VkaInDroBgBrToJaABm2BS75MBR
                                        MD5:1206186CDCF64DAAF9B40B26E438C5BC
                                        SHA1:A1D4104DCA55EC6E496ADF582E9F56C4A936DE43
                                        SHA-256:63CA3C36FF8AEF25630C57A2214BA8BFBD279C9631D050F296DC437D75BB2A5D
                                        SHA-512:D31BF55DD7A454A864DA65BE01AF3B9F3CB37316D8D7D687BC6DC6B6EA5BF4723ABBFD31D7C9C7C0F29C0FA2157446D16EBC061CE7AB8DEB436CEE4FB42C6512
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#90bb65;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#6ac017;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_connected_fork.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):62949
                                        Entropy (8bit):7.982829157758787
                                        Encrypted:false
                                        SSDEEP:1536:SdnxbIe6YkLsoOgdWTs+yDbw8996DqxcRS47UDuCgrTzs:An76YnsWTs1XLn3yR3VTzs
                                        MD5:65997F133AFE7CB19DD8F0C795180071
                                        SHA1:9417A78385E193227C1A79ABE9439A2FC0DBB2E6
                                        SHA-256:69FDFE1E93313B6D23FC76DC1F71D0F100FB47DBBF80096A289E4B83BFC90CAF
                                        SHA-512:441EA59297B6A3B7F31817E4EC771AFC0DCA318FE17E720DCA4B6A43DD3C482C61F5D1A8F75325517BB98F58B3D81452A39C38B9D1112ECF6B10BE1716DD44B0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME............. .IDATx..y.$W}...7..3./...I....H...Yl...2......n.m.}<}...6.=m..3..=....M!@.HB ....J..}.=c..G.{./+........y.."#c...........W.D.....XHi..w..~_).....R..j.]Z.~..../.O.../..@,-B..._.7V...*...o./=...0.W'.......5zN.`lV...........h%.r.%~j..Y..e..`.......)AV.....?...+...@/..P..............@o..-..J?..8......VJ.Z.I.i..9% .J?u.8...z[j......+..........E.%.j....^S@.-.?%\..\\.\.m..o...@...p5..0....w....r5..b.:_...O...0..{.2.....%.g9..8...8t.8...8..z......8..8....{..K...A....`.--<.....k.I.....O...M9%....qqq.s...B.........F\. &.B\TX.JH..b."....A...BEJ.V_x.t{2...0.l....`..\......+.Fr`...`....&cX.Ml:66.<Y7..F>...yl.W..[.&.L..|~d..`...\r..k..*..C.1..I%.&..IA`.D.S..1B.C.$..M...8..E.Z..X.r1.f_\9..z...k@.."..........n7TZve..%.q.f.....a..l..t.P6I(FP..|-.a.K.&....,r....|....s8..vme*..3..sq.s.....U}.......>%B.J...................5=C^.-.]x...{....}.I....pq.s..d.....kM..Lt..$j8Jev...:

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_connected_proxy.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):69081
                                        Entropy (8bit):7.98078809957044
                                        Encrypted:false
                                        SSDEEP:1536:1W2XgN/85rV6TtUUH2yef8XqdrhXuIs5X9Dq0WL2:fH5rV6Ty5ykEqdNXs5X9u0j
                                        MD5:E5CD2C7BA9B105C2E13AE179830F0DBA
                                        SHA1:BAB3BCC2963FF0A87B300A02F9FA686CB30E1000
                                        SHA-256:D014EC74FE25B357D3DEE494501B4E867CECBC3DCBA7DAF7C9995C388E5C8C20
                                        SHA-512:0289D82185D1CE85ADBC84C1046F54A70912E42568DF3CDBD3B649E19FE3B0F62C685C25F3426CC36356C93E52D9D16ACD0DA05A318B31F10CDAC60E76BF0961
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,.y..."m..7.l...@7|.."...4"..pgt$.......@.iGgf.f....GZ.2.8.H.!...BD.$....a.h.}m....{.df..UY...6#......~.2#.."2+~.......e.....;.8...|...^g%.|....7...>..2...]......u/.}P...7.o.sX~o.#0N?Q...o:mC.2..,..C..\.-...>...z.6nJ..q......2....x.s.K..>. .?m....2.n..90.e.....\^.B....@.......... w.t...Ay..K.w4sy=....<......F`...;....2.|.r..A.`C.A7D1.x..).........%..6.9...v.Z.3g...P..9..e..^...\....m.@.s..z... .m.\.RF..<..&..`...=..D......z..F..<.Y..#.[...E........9..As..H..<.Y..#...1s9..F...0.....x.."s..e..s.)...\.)Y.c.>.er2..L]...\&-.@s.a...e.B....g..5...........y .\fS..Ax....2....\.)....>.}}...kgW../#l...V...p.e.o.....,.$...8.\x..... d. ... ....}.....l....w..4.......l.&.H.[..M.....-tv7.....K..y.3.....E....#.e,2..C...n......z8..i...A.p.nx..w..;.BN.dy.......t.....w.It.q.%t..b..U...W.....j...2;...5..e..s.J...n.......o........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_connected_proxy.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):6593
                                        Entropy (8bit):5.024087779747235
                                        Encrypted:false
                                        SSDEEP:96:VkoIanLDhAYOKDYmT/35VYfLD++haM0c8XBrTo8ealWBra2BS865MBR:VkDYnDroBgBrToJaYBm2BS75MBR
                                        MD5:A73D4FA5DF06DB0120444E5C11D8B978
                                        SHA1:B988B93A6EA1466C9F23158508C2130D2AC722EA
                                        SHA-256:1F8CB23FD34E40295B39FFE747177C4EE0AC64167DF47FF54754E12916464D3F
                                        SHA-512:2D26A2A8FA1E451E5C1D0FB2FC5A3DE471C8F40C4A9E03267A286730F2E8BA73019B3A2923D0F070EB5C3B4EB09AC4D880E2E83B53D9800E5F0DC12910CC1B5C
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#479fc6;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#0c89c1;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_connected_proxy_fork.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):60879
                                        Entropy (8bit):7.981421748345525
                                        Encrypted:false
                                        SSDEEP:1536:CsVtpUnjIdD7GyXpOsbhtd0VS8ejXGHvAMCIQT:CjnkpBHbCrv5Y
                                        MD5:A696EA431A0D5917561454FB73FADAA5
                                        SHA1:27A965A78623BA38216BD66365A456FA4DFD848A
                                        SHA-256:3587790E9736AAC4DA7301CB971E5BFC256FF55681A2F3F4BAFBBB870FD582E0
                                        SHA-512:2CFCD80BB7FC29EFF01FA8080B708CD61FE76DA26DA38621E0861220F2679BD664AF57AA30571E220CEFE7E364449D27A88E78CDB38C3CA44C90D27422A232C8
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME.......>..s.. .IDATx..yt\.}......W../.@.$...$k.,K.#Y^.X..gqg...xz:.....v:=.d..'..Y...t2.]..e[.-.%K.).;.bG.......B.....{......@...[..}..w......]....B.,..T._...e..?+-...Z..b.K....?.\\.<G......_+.^y.X...Y..=.........T.k.Wq...2..._9...8...Z...@..^.)...^.=.3...0..H..2.......G...:....C.....k.K..VA.?....0...rqq.sq............K@...j.%sq.squ.....#V..........A.%.......U@.W,&?%\..\\.K..6X......+-<\.......-;\..\...Q.Q.K@..).....r.Z.r..tp.P...,.1..0......1...0W.@7..G..c..`....PiQ.=..a......'pqq.s.8I..."..T\.)...4x5...`..W9.........D.J<.%..$'@.>.B.DL......D. ..r_x...'. $....$.R.=c9.b...S...(.X.f.......u0{.....Z.e..,.B.A[_...5..4~....)........3.KN7.k...1q.....#...q..8.8.BF....f........<l..l..,.2...d....+s..]r/..L......0W...pi..2....;.!.?.Y...'@.q.:.B.P....d...`.e.....e..yd._..'_...S+S.%W.......$.......<....P..A...J.!.G..C.......2_....B.E....O\..Ipb(...P.Usqq.s.U2.h....f.8...).c... .!..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_disconnected.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):66105
                                        Entropy (8bit):7.977649505362057
                                        Encrypted:false
                                        SSDEEP:1536:GuqnPSCFITkIZ+0PTn5mNUSM9iGucMMVhE3SqiPgkNStsZQ21m9S320:EIguj0NUhUwfBPgp9Gm9o
                                        MD5:7F91E463D8115D560C4FB7CBC4227058
                                        SHA1:C0FDEAF061A4BBDCD5FA0AEACAF7A9DFB4A0EEA0
                                        SHA-256:A0944E10E92347ACEE4F95F57917877123DD18D7E64C0CF13A82EE2C3FE82818
                                        SHA-512:49518E5FC4AFFD07F43D9C2E5750E7DAC59DBE55D1BF6D129325CBE03807F1575B7F876CE4152FA8629A2AED476AA46AD1C1A2F55F375EDAF64F723BAF0A6E1C
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,Y}...vUu..=7.;.N`.<..03.......$Y...0X..dK~.F~....sX.O....$. $.....a..f.`....|:T......z.].........S..w....o../...4.n...m...4...G)<....7m...g.../...4......{"h...........Q\...W......Z...h;.vy!.h@.&. ......z-\.(......8.h@.......N!.f.d#...Z.mF........4.&..x@.3.4@6. ...;x..!...\.Pi.;...].4x...z".@..;x.zO5\......5O....U"h.l....3.x@.I..........<.k...<.k...@..v..* ....h....5..L..`[.P.@.^......h@.2....h.Q...-6.?....l4..s......x@.N..j.y.....)@.D... ...h@.........[.0.......c....3........;..i....+....zIQ.-`p?..{4....../..u...R.....Po....... .k@]...o@...2.!..........d..P.h...J.B.s..m....@.V`l/0:.....<0..F3.......8@.4..%....#Mv.....)......f9..Xk......|`...k.b.X........x.X.6... ...X.54.xP.y@.......e..tK.N..=@..`.>`.0.....6~{.`......\.....p......6.s...3......5..: ....*..&.J...<...AC.-..M.1.x.....n,.............\'........g...>.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_disconnected.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):10522
                                        Entropy (8bit):4.949142549545152
                                        Encrypted:false
                                        SSDEEP:192:PkFc0EcY7qRHh6CTChLEEp386Vf1ZvncfIr/9IfOh0Zz2fP:8FemhgVNZvcCicS2X
                                        MD5:6D729F445BB3C138010229DCF6D312C4
                                        SHA1:2E05438CD92FF5F4274964E432A1B28FFD8E90C8
                                        SHA-256:96F4BAE021C1D62AB75259FA48470466F4C26B7AFF7D233A1FC4F686151A69F2
                                        SHA-512:19AA7879FCED3D78ADCDCEEBADC8A312C59DC1D151B5D40A01C7F556B2C5717DA271A23D216693B38F49FF09520897F77402E13839AE481F6A565CB9E17C64B9
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="512". height="512". viewBox="9 9 30 30". id="svg7854". sodipodi:version="0.32". inkscape:version="0.45". version="1.0". sodipodi:docbase="/home/dobey/Projects/gnome-icon-theme/scalable/actions". sodipodi:docname="media-record.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape". inkscape:export-filename="/home/lapo/Desktop/media-icons.png". inkscape:export-xdpi="90". inkscape:export-ydpi="90">. <defs. id="defs7856">.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_lagging.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):74851
                                        Entropy (8bit):7.9882419797490725
                                        Encrypted:false
                                        SSDEEP:1536:jAwnI3nvBFoq1swn1Yp+FmO2pkTI5pFBKLdbelau5mCVe+3yG0:jAt3nvBFSw1YWmvyTsKLdbcaMe+R0
                                        MD5:52621ADCC73C96EDF0F839BB9F0E0442
                                        SHA1:1EFADBF184F9193818BB122DBD19FC39BF2FF68E
                                        SHA-256:4D83FF89352A47CECB29B32658BA34B3C2B37508DE3F3D219FE183FD3C349378
                                        SHA-512:BBEF94F6A79D4BB88BF49B579DF37D6B47F0024A49457B67030CA8258A2114EA947E68953A93CE37CB00BC8766502EAA629E0DCDD8BD11146B448ECE94969475
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...y.l.U.....9......\R.JU.....B ..K..<...6....._.e.........m..ll&...6 !....$.$..@CI5Ow....G..aG.8C......e...cG.8.c.....hE."..?.x......"%.U...|.Q.S.h......h...X.nzb..j0..._.s\.7.).'...7...-.Vt....+Z....1.V.o.h..D.....+p^.Rh..+Z.L...*..p..3.....}..+Z.V......F [.P..pW..l.c..}.....(...@......5..z..O.L..;.......|Vt....`...n..7..b...;...JK^..H+.^.D5..no...r.Y..=.....g.1..:..V...B.@G...-.V..V....F....1..........zE.V...e'.S......";....;..r.h.V."...xE.H..Znc...XS.# >...W.d....-..@wE.....h.h..+Z$..[.?.h~....-.V...M.@s..a..W.X.......r.Z..h5..h^..h.X..jE.I1F |.U4...V...YRbbna....t.$./...Ml6+.jT.U..].............0..c..p6j...<.u...`...h.Q8G..{...|dbE....C..1v...Z/..`..G}\;...............VK@.......|...V...YP.#M...D..YG..;q....l.q...B..B......l....2.v..../."<;..lw.g.;x..=<.......#....c4.9.*..J.....,.0.t[.A.d.#...p..-..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_lagging.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):6595
                                        Entropy (8bit):5.0234758245261375
                                        Encrypted:false
                                        SSDEEP:96:VkoIanLDhwOKDYmT/35VYfLD++haM0c8XBrTo8eaLBra2BS865MBR:VkTnDroBgBrToJaLBm2BS75MBR
                                        MD5:9265B57B15B5E5C2AFB1E4F92D9DC500
                                        SHA1:881946F9FCF507F00A022FF588D41A775DAADE07
                                        SHA-256:0BF5440323D2A3F305893765345EDBB083B9227BA71C62F653C991B273EE3718
                                        SHA-512:446C2151238D088C45B0160C4AB70917CACBAE5280128981C6CEB812D91EA20153D888706AF2E1334B06DD6FE0B36D6225A199C4B59A105344EE5D409EE50C83
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#ef9d29;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#c67f0e;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_lagging_fork.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):63949
                                        Entropy (8bit):7.983366386938507
                                        Encrypted:false
                                        SSDEEP:1536:ehB2gJmDdzuAgauCElwpEYrLiRVmQ2Uc37kr7iB7B:eKgUDdHelw7WJeQruBd
                                        MD5:AD62F5E3C6CA426533A9716B0D38C5CE
                                        SHA1:17E9A7D5CBB7E4B296821DA61B8A5C121B3AEC5E
                                        SHA-256:9B9999EE3BB160B7E98C3753D4902D4BDC43AB0519700D9D12F50FFA2D717249
                                        SHA-512:38F35A534152AC081D263D27C93FB629FD04718040BC2B4EE5868252257A4833A04A912F3C7028355E40A2DA354FD50EA3979ABC9EFDA3F7D31EB10C0C6BFDA5
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME......(...... .IDATx..y.$Wy....{.UY{wW..Z.... . ..-...m.B.\....;..c.....=.y.kc0 K.....F.@.HBF..P...V.....GdVge...[.y....+###c9.x....pqq.J..PZh......+U.{....g....Z.]Z.~..../...../...@,-B...eX.7V...bU.,............"..Z.S...c..O.g...`...@+..+~...iKf.bT..........R...@..../.#V.d..^........%.P.....p.e..K?..8......VJ.Z.I.a..9% .K?u.8....[j........ry........l5...p7..........0.W.%.`.(...e................].W.9pC...m~H.8...Z..p..~8.<.X.q.......C.......k`............\.......X.......8..6.$.!.a.D*...S.p......0...b......(..O.......e..E@L....q.".......}..=...P.H.H.u0.[...C..q&sC.p...".a9X..eI..b.X..X..X>.....|j.:.ta..`..G.......%...,n7..x.NLOG1..0.J..D.H.[....@.$..!o.+..i.......7...x#..O..S.i...@..L......0....Pi..2...o...q..*..."...(f..q.c.7....Y.........9...^...z...7le*....sq.s.....P}...#z..v.G._..[..[.p!..f.l...6..-.N....K8./....Ipbp..S....pq.s..d.....j.q............

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_waiting.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):81206
                                        Entropy (8bit):7.983144606747959
                                        Encrypted:false
                                        SSDEEP:1536:uJOWFmkX0woejGhjQw/XVzAVwROKD/mkOrlyIDhqkf9mEenq81CgKt4de:uJXXX0woejGMw/FUVyJ/vuJDZ9Ckg24Y
                                        MD5:A3E497D845F86FE75D0B134285009EA0
                                        SHA1:8291F177F130EA0EC8B6774E2C463B9E93C6FAF8
                                        SHA-256:4AD2A90614526CDBDECA976DA1F43BCFC1DB2E00118711C5A3D39733FB7D83BE
                                        SHA-512:1BCDA9560E23AF1C4CEF82AC3892EB4473D2C23009CAEEB4D77E664E5B6C00AFF0B9B9A3B1C7084399BD9648493307BD5905F99BCFBA2230CD451C6C60A2AFBF
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..y..Wy&......{..[j..n.c0{0`.%...5.$...L&...b93....Lf&.M....IB....2.L..0.6.m..^.ZU....}..n.m..u...}..R..V.S..((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((($.k.-.....X.ut.X..((((((..;....L...n..{.......n........!...LUf...U....{..<......$.e......K...h3hQ..M...K.17zbr....c..uPP8.1......0.!....z:..{...y.g..H[.. ...r;.mc.$1.........c...e0....0.......8.N.p..'!.v.z..m....kVP8.s..w../.8/.....g..{]YP..0......s[..m......E...a.....Y.5.)..Ax.....`.B.If~.t.}...}|....0....2.o../..[...9...k."`...kg.....k.&.gC.Y`\.`.. ..0...0..f.....z..k.<t...Z..)(.'....&.}..gHQ.#?..o-......Xa.0}.L.......\........^.3.....G......?`........{i..k...o.O.....J...~..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\status_waiting.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):17633
                                        Entropy (8bit):5.101367370782234
                                        Encrypted:false
                                        SSDEEP:384:8wj75ePG9o0fnXvCsenMPWQt0EcFeHLxlWQVcnmN:8AYeXaPM+Qj/WQVcG
                                        MD5:B25E3F0A10C42926E4F17DFF4616CA23
                                        SHA1:077F51CFB455EED7EA10B1B15FDFA63FDC798C37
                                        SHA-256:07D8E8DDA01ECD8E17FE439727287FA4794384E01E9BA2D17D14822CDFF04E07
                                        SHA-512:34CC1A9DD6043D522740BD17D30F81F4D0197AAD51789DECEE98330F24E7B60DA072B00E24DF2E726E488105BE1DE6A306C6E0151AD3937A797ADA0806233379
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". inkscape:export-ydpi="90.000000". inkscape:export-xdpi="90.000000". inkscape:export-filename="c:\Tango\git\view-refresh.png". width="512". height="512". viewBox="0 0 48 48". id="svg11300". sodipodi:version="0.32". inkscape:version="0.45". sodipodi:docbase="/home/dobey/Projects/gnome-icon-theme/scalable/actions". sodipodi:docname="view-refresh.svg". version="1.0". inkscape:r_cx="true". inkscape:r_cy="true". inkscape:output_extension="org.i

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_addresses.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):886
                                        Entropy (8bit):7.6289522162101475
                                        Encrypted:false
                                        SSDEEP:24:YMd6kufXgEfW4mgdLg0dEWMIyclXDkS1SpiDLgcv3wxVH:Bd6k0PfhbdLgsrF1dDL13wxVH
                                        MD5:AC4B8FA4390A63008DAA29AAA572F92B
                                        SHA1:95C8CBED0038D022E72D76BDDFAB933477C86997
                                        SHA-256:92A0F0FAA9108B03A7F85DC4BB494540C7A121EBF3153973CE0A0B1ADEA5B4F4
                                        SHA-512:62580A08F5D9820EDAD835774BB9C844DEC6DE626C9201A2F363924E7BEE3F0C31B76AF787FED645CF9AE8D3C9B55D233CBEB8A1B93C78A9CFA4C6D15852C683
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq....=IDATx^.ZMh.A.~..D{0..F........^.Z...........U...m..&......*..j.&.A....L[5....$#3..l.U.5;s..^......{;........@3...h....:.j../.J.A......[v>..]?I.b..!Yk"......O..!g/....wC....J.!.^.ZT....b...g.D|...Gv..J..Rr.i....\V..r....t.j........P..N...iSe.js..\....%..p.U.>..Q..4v..eV...u.?.:..hW...6..........Ms..s...`n......;.y.....7O.......4.\..aj$.4.m#.z.f.9......v5.7`&....@$d.w.&..`..c...F...[...._.0..........flb#....@...(..t.tb.d.X....x.JlL./.,....*.B..voW.y..F...%....~...lg./..'A.... #.....YB3..j..a..k5X.....>o.7h..c.Kh;7p........!.Q....VX'.j..Z..e..m.....R../=.........P..d.......FH..P....".DP+.dd.....A...Q...[.N.NL..s..o,.n.<..]AF...NPPl.i4..n..wG'A'&A.x..i.h..N~...i....*....5..W..S.\...y.....k.j....cJa._%<.y...g..=.r.............]......u9.<I...h..yD..+..gk............6.....4.0(........d..I^......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_coins.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1592
                                        Entropy (8bit):7.788494723888087
                                        Encrypted:false
                                        SSDEEP:24:L0oFc4ZD0wVdHvXH93UmPY3mDVkVJ7hs91JFnueYMv/wEfxW:lFNZFXd3/g3nV49b9ueVtW
                                        MD5:1EE6C2BF2A3AA970E939A290903F3AB0
                                        SHA1:8B0B56829FF0D439B644ABAC1BDC2D2E1F8C3A8A
                                        SHA-256:9AFF6228C45DD2447A0D9E3DAB06D6C10818265B41D61B6BCDC8B8DE193CA6F5
                                        SHA-512:9A43B724C16AF2686545187BC565A3544A1A311F5D76DDEC8CBDEFD5A24DC624F648A09749CB12DB89B0C7E21B67ADDB2A1B474DE4C96C37F0A99A27A1B6258A
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^._L[U.....[h.m.?B#,!.-.......^\|1{2q.1...'...........,.(1dq....2.EXA..u.....B.....9.B.....[...m......s...sz..x!{\?d......$s.......U.c...J7.......A...#..[..q.........+.....BbE..Bi.....=Gj.z..I+..p.j.!'.vPP=.7....s\........6.........T....p...PY/..{**....K......0.6.....u*.%......%.y;X,..@;.r..S.g......CL.@`".X.;..^.n........q.....|.`.T..W.%8..=@`............c...N}..F.j.?.a...%....k.'.....+!...&.(p..k..........f......V.Y.#.IM....,...c.ol......w&X...r.S.<"..W^}....8.2.K<@...U..A.%2..*..?....e...#8.<..ysZB..2.|N%`>(..&.....j....X......O......'...0D.1....>@.....}...d. 1#..x.e..u-.1"....$......o.8..K(PL....I.9.Z-...(fM......z......~.Ky?.94lG8.....H.%...z.......=.....<6C.........}...o.B.e...:.#.V..../...I.~....9..."H.5.O?.~{...<.m..A0.b..\...k...C..@..1t.z#.[.....J.....m..i..d.....U8..{.}....r&._X.T7.....X.T........F..\.......O{...@xy.G.NX....8C.@Y.u~.R}....m...l4.l2B.Q..O..B!,..0;.[{-.xn.6.}..>.."k....>..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_console.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):824
                                        Entropy (8bit):7.612514809801685
                                        Encrypted:false
                                        SSDEEP:24:+ZK4Y2G9OPn9LW2qdM46VLQXlt3ePqvHnvM/Yp:+Y4hH53vqJ
                                        MD5:BC516311DED0419013352FB03492ACD3
                                        SHA1:EB601A41D822FEC612218FF85D03F2E1564AE2FC
                                        SHA-256:DB79DC87A2240DA85B585291B442571E98F18765CB493567209E075D6BC87432
                                        SHA-512:C8608D97CF82B1E7356E942C33EA5607ABE9E4A91C469CF32879B4FC862BCD18F4EC9F4FC708668598B1EC603AA4D722ADE6D365D90F414C6529793FF175E60D
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^.?l.q..P...hb........J..M...uQ...&N...51N&.h..6e.....&.M...`..Xl+q(...Z..(.5w..Z8...{.......{...w&.|......"...(....T.+.@(.....a.F...w...e.D"..)...0..@...x..+n.....G>l.N.d..D.v....V.)...............$~n1....].........d.m....m...f.V.....Eq..._.).<..1...i..F..|.VxZv!.>.5A.......moL..*).....a...%....'...w.,.....)e..aV..^Os.1..n~...=...9t..q....b... .........pp`..P.P.P.."H....A.....F.:A%.p....L..2...'BA...a.u...* T.PPmy.B.a....B].3.....F.`.?....jMCU.9......q.\..d..H...Z....rn7.+....,....?..ri..$P....Md...z..`..|.8..n. .5x..7_..j.d.z!^...Vwi!...:>Q.B.*....}5..v.PJ.\gG..`..+.....x\..U3$E....b.<@I.Q...4...p.........J..9..:...%..P....@.h0B.!...l...4..7X...d......%..,.b5h\..z<p.\lk.{7.c.Y..........-.......!...."E....{o)..3...<.<_...1....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_contacts.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1446
                                        Entropy (8bit):7.8007038316507105
                                        Encrypted:false
                                        SSDEEP:24:OL4aM6GupQZ2f8gnuW7jln85omyLYbyR+6YsHovESL8ee81qKG7TMZXD8bWL8Y6Y:OCDZ2U4lZmyEztZL9e+qD7gZXD8iL8YL
                                        MD5:0788B8FF813FDB1A30027FE5365DD696
                                        SHA1:990EA3F4929CA78826C8A705A812ED9CF42EBA5B
                                        SHA-256:577F8E407B16E76EA191101943A67235F3BBE18715A952A425BEF123DD0ACDEA
                                        SHA-512:47C9CCB8A2C77F8D15059760081169583F47EA93A014B775734FC50AD4A5A7C843946BE022F1DBFE99BEAAEC40833CFA5BA28E24BEEC77A63A02124A0331DCFF
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq....mIDATx^._lSU.....q...F...D.......B...X.O..bd..M.....x....d....Hf.<h.h..a.NL..H.)&.!..j..6.........s...'.C{.==.......[F...En?....,r..\.`(.m|.q..g.Npk.o.1........x...I....I%......:p........'C...d.Y.j......./..<1....D..<9M.V(nx...W. h.4GRo...Ti.c..A....O.\..D4u...I....J'...V..hj..-.E.D...t.j....0..0..t.."k............``!$.W... X.Y.).H..&...2.U....^YO.v....0..k.h...9.<}........2X..(..w.Q...h..gc2.\.....]/x.....b..}...5.G..!..y.........<5.4Z..-...q....z......XEH......W.....]D..)Po.k...@9......*6?....l$.....<.=w..|.p`x3...V....M.(..y.6...s.........I..e..~.......iU....R.7+6.....[.j@C<.yb.l.o~..-[...r.e.D.S'... AQ......o.PW_.,..>..X..,.o..e...j......c.v...e#0aY.x...>.{ES..|a....J......./..R..j.....^.0.ECJ....s3VJ4N...{..-..:P._4....P/...{f.g...e.H.....$..{On...........e...b......... .?5...O5.c.Z..p....O9_.%..AL. ...V..@M..{...Fd./.........h...:@...(@..N...>{?.Z.e......J.$.)5.*q...T...Q+G7."|.......4.....`.....z..e..vw&...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_history.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2182
                                        Entropy (8bit):7.871959525865307
                                        Encrypted:false
                                        SSDEEP:48:roXG+Tqgihlr7uTJeZjuqGBeMdcfYSQInowB5SNpuFa5FEkNcE+krsUaMc:r7lS9afXFowiNlSacEdslt
                                        MD5:EA743BB14A4E4163525396D7E493851F
                                        SHA1:9E7D59B26AD3EC8514B5284314C10099C6C81AFB
                                        SHA-256:F6AA1E2287CBE64D4D3248DEB96EB506D619898BE1E4726A75565FC3148BABAB
                                        SHA-512:5AAE68B6CF0328CBDC0FD6A9D236DDE6375D82B11A34A98F9577CCE7A87199F969EE124CE5F82B7EB109BE68C723063778506D34ECD7AAD251010745A0E0F5B8
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq....MIDATx^.mPSW....$.I .......,.C..0.t.E..mgv.]....H;.a;mgZ;.S.e..3uwv...l.n...e..F+..6.TP.% o.BH...xw....D.r.....p_.9..<..<... . ..G.@...@D.a... ..@D.aN ".0w....H`[...4.*....p....ib.l.........M......8..Z[............5".".p.$`4.b.j.y.#.$E..R)V...T..E...v..-]79..)....~......V.!..x....:.o......BvJ:.e.#?5.K.1..&..h.n...Mh..X(D~V62R..... +......[.+.*%#(c..w...3.A.!7=....|....?...m.f...m..#....x..@@.....q... ...|........E9.y... ...E.....sS..W....O~..q..]W2.....X.'.g'..k..IL.}j./R.3...]}}.1.2.. [...,..q.>W.D......x.."....Ue?...u..&.._.."$+..<}...N/.4.:9....K.%...1}..$Irt..hK....F....!...@..M..C.#;..........<H%.[....J..EC[Z.....?8[...~... Y..u.._|.K..>........'..H..id..PX.9.#}...p...b.\...R...JlX../iy...H..lM......2.Q..?.j<......$......<...W.....k..0....F.?.....?....8......g....`..._...`.y<.PV..6....;^=..G6A..M.o...e..J`O.>..."-.]D.F..EGA[..O.7....3HMNF.R)s.r...z.=;+~..'B$....m.7..=[.....).B.Qw..\..,e&..!.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_receive.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1873
                                        Entropy (8bit):7.847348495097636
                                        Encrypted:false
                                        SSDEEP:48:ack/QtTQik0K+GNXSwUmiK8OIkg+t/zTsFB8QHqMl7OW:ack/QdFK+yCROIkg+tbogQHqE
                                        MD5:759229A9E6A227E749479D3E38ACCAEA
                                        SHA1:59A1CF1616D6B0EC427E1D26A20BD3E5D17F0905
                                        SHA-256:F589CA31504FAF427C5AA7AD42E413D0808A4168CDEC02B09858A186460C1E09
                                        SHA-512:73090EB181BE0C3DD8961D1E96A8FB9E08F6CCEFB8A2AAFA3BD9C6D6A729396003E0B5DD5AF34A2D7CDAAC786E566B2E6200352EA826ABDC6A402C2DD140C67E
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^..O.U..g.e...-...h..G...|..6....5e..iRM.&.&j.J.....&....`..6.P-.4&]m.1...J...X`....2.;...j.O.=w.9..g.C......c.....s..[...p......h%.-.c._b.y...b.[R.x..3.to*..`..H.r...X.X J.....I....O....q.......~:@DGS..v..`.\.;....W.R.A...,.HI(....m..H..G=.........<.^`...J....O.....(.!.../w.|.a.@........MK...-..i.... .f%.?9=.01u.,.w........86Z....a...j.......iY....I...f..X..-..:A..{LN.`...V.3..N.o.. ....X...../...g..G...0.b_W.kCz...1.@..u7q.&@./.....[...5..kw...}.>3I{....e.kA1....N".N_8......a|....?..1m..>..*.l.f..%.........O..............m./..g]...^..+7./.Wn....W153.....m|..{?.)..S.t.`..6..1R.........P.....>."....#A..5..x..2...N....zo.......@,....@....z.0c..t(g.l$...`.......0... .) ..F.....P.m.v..*9......f8.|s..^w..C.:........3...}@z0.L`...<...#x.@..KW....*55$...@r.....K+.K...?.Ba... v.i....|......`d.o..a.|......Xd..;:.z.Y4-C .,5.c.Y...t..oZ..I\d..{#....>j....5..|."..L'....W..#(@.UE...=_.......A..Y....e..Hx.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tab_send.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1550
                                        Entropy (8bit):7.801347642580139
                                        Encrypted:false
                                        SSDEEP:48:P/pJ59aQ3CDH4Hr5r34AkCO7uN9fpsTrq:P/D5913oHOVrocUufCrq
                                        MD5:60E2D5CEDD24680A2ACE067443AD2621
                                        SHA1:2E262FDB4BAA4F0825BE04CBD2F8CA8C2E0AF791
                                        SHA-256:FD2BEBD2DEB05AA9A4EDBCF112A42AE2AF4E40608D58197A96AE2EC15F3104C2
                                        SHA-512:29708A046E52327A79D141056D1280878672976A863D7A120A5CD13D78B6D1B02D83C6D7776B03F772E0837FFD1BD1FA60BFC5B0B8D042B48D761B7454FFC106
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....IDATx^.[L.U...gw...[..z.n...XJR....J.h.I....]..E..L.(....|....hb...bL..6`..@..R`K.r..9#K.ew...v.v^x.3.|......-...!..Q......DS`.. ........].<.O.[*.\>....k..O%@.....m2......{...d...|eN...|...;......M..pA.qwp.iI...(.w..sN.@3>:...^<.a)......1..f...1.4va..1....d...@&...1..[8\..X.i....k...E.8.....-.C.B.Tg..X. .N...t...W..;.C.."c....c..X...N......s..?....X.2y."...a!..8........kp...(Z.....w85....... .....%....P.%3......D.5.N.G....A.xez.^)...n.~2...C.@.8.lhxR..{C..fjb,..]..1..;...(....Au...V.I.G...].cey._.G..u.@.8..;....q........*..|....QX+..#..v......@..>...K....Z....Z.i..cN|w.....f...\....Ex....E.P.i....q.+..p.....2l)\.....!..*8......\.N.f<ykRQ.=..>..k...8-^....\..?..../.....<i..*.x...G.]..{.Gf.''Xp.,_v...H....E.y..A..F..nd.5.>..#...83..C.?............F..vk.]i...~..H..z.KK.S......H...aU..zA.i..P*^\.BCKO.O.....Ej..i.W%.m..M.2.pV.8....x..s?.'.o.D.=......~T.......o.".....(Z.......@.)..o.".]..d..e........K...E0.e..3

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\tor_logo.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2712
                                        Entropy (8bit):7.897509548266366
                                        Encrypted:false
                                        SSDEEP:48:OBYh6wWjHXqGQla23JWOxBqj3taKc6U6pt8XCFPPJsKfinrJHO10knEmRXsHr:OrL6rla25WOxBq7MDN6f9x2KarJMtnLo
                                        MD5:E984E43EA26ABDE50C0679243413BE73
                                        SHA1:1CDA2539FF5AFEBE8B0240A7A53CEC96E59166BF
                                        SHA-256:D3B9D45B853AC0ED8040743435131943A290BF477F84FB596C3F1B1788CFFECC
                                        SHA-512:E751D281C2E298FF38B756BA93EBBB3DC355A73DDE2460A1AC9E9EEB9163C2558E7399A5A0BC8441DEED2CC1F068980B8F700BA03E9FA802B117D0C7CCDB5B4B
                                        Malicious:false
                                        Preview:.PNG........IHDR...@...@......iq.....gAMA......a....OIDATx..[iPS..F...T..HE.DCN..e.(.)B.D ....&..Q.m.."*j...X.2#Ej...Q+.Q.*..T[l./s/3....yO=.IH0?...7......y.wy...ttF...q:cy...u....#..#...?7._..A.#.......g....}v......k.K..o.=......Z.)zs...:..to..m..r.1......|...5....R...n...=.p...[..5s......7H~. .H..ZC...M..."_.L.|.....v.............;}..o.j.k....;.x.|.U.(%.T.]..?.Oq..Pt..j;..5......P.dT.&.k.1]._"....2/......;..9N....5.G5..j.y\.'Yu..X...Y..R....H..`.K.g..g...=$oo.u.O..X.q..].d.!q.....?../$..T.6...V;.....o..L..X)..4....&...2.P$.59i.l{..)$.0....Um.../m.6.:l;...A[.......7...9gl.Y%L9.D.-d...,.].J.=~R.u...o...#. Yd..V.B)dGY...&...\&..ZA......q&s...U.zzSP.....^J...+../....<yr..Y.K.X....'...=.\g,,..T....^.:...<`..L.....?q<.}..f......"./..B..N...3p..5x+.v..8..t...........{l..d..XQ......cC.GG.FE..O5B.... Y...gd..Q...h....o.[.n..Bhf6......"x.e..../W..].......h.w]......\.<]...............l..}b|B.=........../#.(@.........^........v..G.<......}}"9.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\trezor.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):2606
                                        Entropy (8bit):7.87590276765234
                                        Encrypted:false
                                        SSDEEP:48:9GyHy2I0ptxc7rfVIZzhMUinp+mLxU7bM5fPfN3bYgZUdyXcj3:pS2NHWrfV0zLinp+m+7IBZbYasr
                                        MD5:BBFD133D7E3BB9166A72AEFF44039DD0
                                        SHA1:B793265348BBC090AF7B9E860FE08D75477A9F22
                                        SHA-256:FBC9CC7BE4BFBC63D013177A8D5F6D45E5B803F3AD18B9D3F06ECE241387DD4E
                                        SHA-512:69787575A49FDC93AC08F0E19FF138DE9A8267A95A6D6809F90CDBDA34E511226F397B860C9BA66A2BB39A4CF2117F3939723866C119BF1BCB560C03741F8B4A
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs...#...#.x.?v....tIME......8X.<8....IDATx^.kl.........N.b.DmM.`S .K#....m.u*.T....j..-Jc.J..AJ.~HK.*M..U.xT)`.A...VI...h(...[...l.w.k{wo?...].xf.3.......{=.9.u..f...,........+.%......H....x.8......u...C..`-P.|.....L.....^.-...{...ow...F.(p.H!/o7..A..@#p?w.K....L^8...~.....Cy.....\...._.[HWp.!M....:.t.....Ch@F../.....s.s......N=.7....#T..bz.K.3.......4.k.n.7.!..@.H.#.i.P.=...<.Ly\..,.M.._A.|VP@..W...9D.A..V!+....".n+BjH..G..&yg....7kb.i......z........0.y..._A..y.\.OX....Ad.l....HS7.C.....f k....K....u..R.<...fu%..0.:{F...F..f/.>.E.b,.!ducf.)..(./&w..2..r..w...s..qJ.......^\...[......2..7`.....v.L@..6.4Y....vf..#.Q'..t.f..2.L..)..`..2....`..X..ADt....0.>..cw..e9....)..Zf..Y.s.3a.~.N.S...F.`..u.;.6b../C.t..q8..2Z..k...d_&`.{..S^6..1. ..%.%\z.v:...).A..x.&....:U..\..,..~K..X0..g.f..Y.sdV....0Gf...;..;X.......S..p.8..M.>d_..f.s...#....f.]....K.A.}.f.\d...DrdV..q..O;.P.,.....X.v-ee..s..........9{.......in\..m..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\trezor_unpaired.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1950
                                        Entropy (8bit):7.797132462932182
                                        Encrypted:false
                                        SSDEEP:48:9dpnb/9pz2F8k60ff3UDxvElEN0qaJQsAhgFYQ:npnp1OUDxvESNKehg3
                                        MD5:DD744CD63E82BF20B1869CB2574E26EF
                                        SHA1:C0AB173E75DF598D98B6CE2576EF01DD0FFDC6C3
                                        SHA-256:CF02055B85C86E9C962C3A9CDA299D90A378364EEC244E31ED5A17EAD2D84C81
                                        SHA-512:28B6503F1CDC9620BE79C5764063576FBF3E15E3264ACC0A63E9DD6C8A83EEB61134A2949DD7362F2BBB830DA0CF4EA7E38D19D1768F99149AE831352699D962
                                        Malicious:false
                                        Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs...#...#.x.?v....tIME.........L...+IDATx^.[h.U.....4.D.T."...".[+.mFQ...*>..Q.... ^C..}(*^../U4.`E.^......"D...hic..5m..._6.nf.........s.......)T.E. D..f."...l.T.x`.p...v....&.W`.M~e.....Z.%@.*.4...;...v.?..O.m.........{....^-.....+..8.8.x.........u@-G)....c..).2.o..hUp..CC.'..:'..t.39J..m5K!^..G.z*.E.7.V.....Q..F ...<.em.p9% .+.....{.....v.. ......Q'..%..Oh..x.,.v........./.-.x..;...\.\.v....C...w.i#....M!&h.....4.e6.i...k.~.yg.....V.'.......A..^..<........b.".bt.a.....p.}6F..O.u........gG....:.7}._.....tttc.....0.>............h..?.I.S.....K(..`7LG...B.@..oH....D.<.DS.b.J....3.8.N....hu`..h4%*......L.!.......k.5......1...G*..p.W.#.....*.O.....dB.z.K.S...N...../...y....8..p.4%tA.....<....O........d.!\....Le....u...PQx.@.].B.}.X.+.,.......(U.}R..'U.}R..'U.}......$a.D..H.....+b..].>../a.8....5%..&t.."..]..3%....]mD|R..'a.p.,.1.H`Y....46.........Kooo....v.p.B...i#A../u.#TD$!".ccc..."

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\trustedcoin-status-disabled.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 54, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):19933
                                        Entropy (8bit):7.574534972019669
                                        Encrypted:false
                                        SSDEEP:384:lo1/vtK7MqGFjjvOBncKJ3aIXnXlyY7pZnwVAreANbBk2/urYl:laM7zGpN+aIXnXlyY7pRwVAiIba2GEl
                                        MD5:64CDD6A1BA368CC80D4722DD87125C2B
                                        SHA1:CF9F64404F9422B5722902909279B3D47F0BC5E3
                                        SHA-256:F48994C54E979CF844F8E47E0FAA309E45206FAE81B8B28EF26AD3A703512056
                                        SHA-512:D57AE5788EF747D55D987FD335230666F7FCFF12A37FB217240AFC1DBE9B0797EF0A28C0D17086CC38FC054B50D64D05AFE6D0490AB8C787EF524061244A1FD6
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...6........../.zTXtRaw profile type exif..x..i.%....c...L.a9...-_.Ad..j..."+...F ..38............./.[m....'.........;...~.......T~~..Q.+..m??..~.~_..2...v..~~1............F......=....s..=./..?.<.......N....a......6.b<)$..1.o.I.E..~....0.....R.?.cB.m.~.....P....r..........K...\~....`.."..O...s...............v.3..#....<.Gy...-t...Z...K......P.~...z....9.0...}]a1.....ob\1...Tc.+}..pcM=..X..'~...%..v..[..;....XP\.......{..A..~.q..f.Z9...X.p.&.......?Z....fY)...]bZ....[....._.......qkc0!...ZH.J.5.....X...c.q...,n..s".jlQ..-5..F....s....TRemz.,V.F....A.e3+V.Y.QR..J)...GM5.j..Z[.u..r.VZm..6z...^z..>...\y.....q....Yf.m.9...UV]m.5v.i......{.p.....r.i..q......n.......j.'m.....Z.Y..VJ/..W......ApbZ3.,..X.% .....s..i.|.d.E.iZ...b.`>!......oE.r._..j.....sZ..p......m..z+.e.&.'.o.......W.}...V..R/L.M..[.n;..v...Z.#..N....#......N....Q:..y..;[.'..}....S...]..k..{.......{.....,Vn..^.............\...Q...........tk..F$|2a:.l5..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\trustedcoin-status.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 50 x 54, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2034
                                        Entropy (8bit):7.660239465649274
                                        Encrypted:false
                                        SSDEEP:48:0li631SscJ1VE7Nmo7qs4Q2Q0ZfoekC7XHln7tT0ny5SLsE1Abr:0LFXczVaNhSQ2Q0+eX7DZ5OQ/
                                        MD5:2BDE89330B50F80C329AE96218ED4407
                                        SHA1:808B69490EB31F7DDB389C40C873A1DB3AE072C8
                                        SHA-256:59483C610D70606C486D6124BE50FA8FF11CD135A8C9E01A23FF6B6EEF34AF0D
                                        SHA-512:E0BBF4F3D7EEDCE48FCBB9D8AB40097BD56CB6EB49F257228CC96F05140D75EBE8348E9EFC840FFA8783B9FE1EA104EF51C58807DA21F212FBF15D961810AD39
                                        Malicious:false
                                        Preview:.PNG........IHDR...2...6......p:.....PLTELiq................E......................T..................}........2......<.J.............,. ....z..`...........r.......V........v...6...........}..............H.s..................O.7....................<}....Q..N........................6.............F..................................".................................................................3..............;..<.....-....3...........*.....t..........!........M.............:...........g.................].....H..k.....T..!.....W.............)........l.....:.....a..t..s..%..5..=.....G.......z.....;..@..m...................o..S....s.........a.. ..........................O..b...........].......B..f...............J..........."..I.....J..........P.....|..w.....#..s....P....ZtRNS......$......9@......../D.N.i.r39.....a......F.$.....b...\m.g....>..7.d..d#...Tzv...F...(......VIDATx.....$I..s.k...me.l..m...m...t...55.......2..#......6E.C#f..b........Ggc.I+f....e....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\trustedcoin-wizard.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 78, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):2206
                                        Entropy (8bit):7.856793550146874
                                        Encrypted:false
                                        SSDEEP:48:RtLYoH20oBpJMBYgo2ZYvCifHAWvJRtt+y5a7+ZN:/8oHNyG9BYKiPBJRtt+OawN
                                        MD5:4319812521C3BBEBB5A1CE0921C67FC1
                                        SHA1:23E7B2283D9B181ABBCE90808F1175CD39BCDE66
                                        SHA-256:F4FC9D6E66B0C812F34854C5047506268C16B861056DF140535A263A98B6281F
                                        SHA-512:6FCEE42CFA23683F3DFDA3D6BD6AB8242ECF758BCCB7CA59B8A7E60D1173FCA2F1F420CD4E277E904AB658781F587A2DDA3887D61EEC42684E511C81B53ED10C
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...N.....K.....nPLTELiq......[[[Y^b......C.....K..............\\\...................................]]]]]].........XXX[]_.........ZZZW\`]]]............[[[...TSS......^^^]]]......`[Y...[[[...^^^SSS]]].....B....]]]...F...............................5.....F..-..&..... ........k..N.....\..............p..;..............@............................V..........b........z..^^^.H.r...EtRNS.%.;.-.....h...Sq\.q(.|..J@.f.......FP~C<..N........E.t...6:.:.;.b.4+s....IDATx....w.>...>*3.v........H..:.033..k.q.Wn..[V.Y...2........>.?.....|.....VoIn,}..*`....M.G....Hi...`h~yc.Zp.......#.._....&..~....G,n.y...pc..._,P..=^S.e..N........\.z.Z_.d.....,JJ.D~..Rl...~".b*........(..BC.].r.+....TU...&|..sFn.~O(^.+.)W.%BEO@..L..[....oF.$...r.N..j.....~.Jx.....N....2.....[..7.......'.....c.....-U&.....).l...Q?.(.#......p....9g.sx...rFA.......1...TUp..........ef.qi)i=F..o.......-QN.....FL..D..m.9.S.7.m..J....hTv....+....r......Z.:..j.8 D...r...p...a..X..X

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\unconfirmed.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 100 x 100, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):3532
                                        Entropy (8bit):7.5891737213090185
                                        Encrypted:false
                                        SSDEEP:48:f3QHXMNzJUXj8XPh3otxZLXjnoGbx2qXMhgkgbSBAvdYKeTJua1xTXhh7s/q:vQ3yqA/h3otxx8s2GJdYPuaF
                                        MD5:72677CFDA5DD751DFD4E1077ECB499A3
                                        SHA1:F157E625D084EE85E8028230C6BC9E002CA86391
                                        SHA-256:A3C8EAB530A557686719B32027753E6CC6B0DEE76AFB041FC01951A8611B05D9
                                        SHA-512:D6B9CECD94973BD79868C833CBA45C7CAE9D6485205FA8D70EE031F4F596B74BD7A4909FBD256F4ECA932FBF124837DD9740FBF6A45BE93E95572819C7A532F6
                                        Malicious:false
                                        Preview:.PNG........IHDR...d...d.....G<ef....gAMA......a.....PLTE............................................................................................. !!!"""###$$$%%%&&&''')))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@BBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMOOOPPPQQQRRRSSSTTTUUUWWWYYYZZZ[[[\\\]]]^^^___```bbbccceeefffggghhhiiijjjlllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}..................................................................................................................................................................................................................................................................................................................................................................................................................................8.W....tRNS...................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\unlock.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):45956
                                        Entropy (8bit):7.971545234009563
                                        Encrypted:false
                                        SSDEEP:768:8k9/w9PXN26vaXa92He7owtuKnMfAgqlQNkpBM2arxIJOaLfPtWfFMlHJLw3/Z:8k9Gd26vaQ1PM+QNUvIxU5Rw3x
                                        MD5:EE2E1C80E44FEBF375BA777918A9FB4C
                                        SHA1:138DE76DAEEF169D9FDC9E332B4658B010C8C65E
                                        SHA-256:AD0BDE11FD020914782CCAFC15EBE2C9C01F28D262E51CC8983DD79D8D9DF5E4
                                        SHA-512:C926201F15F64954B4DB42C6C38368A4C10BA641AA2559C49174D09179648697966C48F6409E32773AEC60F21088ABCA89CBB75EBEDAE94CF1DAD6899581A798
                                        Malicious:false
                                        Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...y.%YY.?.efUVVuUuW.;.8......*H..4*......7d..b.Q......p.....(.2..#......]]kV.v.8..sN.9'".yo.{3.Ow.}.q.w9.!..01...G..qTu.Q$t...3V.8HDK.^".........&.....`4..h....KDk......4.G..."....b.....^m......y.s...5....M...a.y..^}...k.u5..g.5L..X].......(...u.g..a..1.e......y..su.?...<;....... T...j...........[.t...i........>M....b......K^...>8A.WD..}..'...P..../.....U.>.9.4.O..#.|....o~.?=.)OI.}`.0.....W..U..4}.4}........g......a....A../^.|n..%.......y.._yK..M..&.....i..>.K........w..8y...f.a~......y.k..:.k0...o"..i..P...?............$......'x.k_{+.~..O".Q..i..04.............$"..A......W....0......C.}<..........V....Z....s..w.}.F.{H......>.a.b........._M.`.a......3...(..?..?j~.c..o..3....H..b.'....";.(...f.).......0)..S EPJ.q..RHT.R.D%.4..(.|0]e..=&;->..BP.U..p.$v.....343.5.6..._.....H.4......a......,....Ms

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\unlock.svg

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):19461
                                        Entropy (8bit):5.028084132524802
                                        Encrypted:false
                                        SSDEEP:384:sbom6MkCX9CwqISAHSc/8EqFzvacL1a2oJtcLEY:s0Tc1/jsvacQCLP
                                        MD5:9C4D31CD803676CA56DE268BD1AD7635
                                        SHA1:823208D92351211A5FEEF301D26E62515EC1939B
                                        SHA-256:75F4AAC7999FC470270A75BDE3C73870C9D8E235CC40AED0D04830B46471A30F
                                        SHA-512:E7DA269DDCAF8B1B37C28C0B39B6A33D1D46022CE12E38CFC81B4D8D7197FAC2C7CEB8AD134675C0D7E4C8F0F8E5B21FE51999E28F860A60AEC6868B18759EFE
                                        Malicious:false
                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.0". width="512". height="512". viewBox="0 0 22 22". id="svg2". inkscape:version="0.47 r22583". sodipodi:docname="unlock.svg">. <metadata. id="metadata58">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />. <dc:title />. </cc:Work>. </rdf:RDF>. </metadata>. <sodipodi:namedview. pagecol

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\unpaid.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):23805
                                        Entropy (8bit):7.980170255740335
                                        Encrypted:false
                                        SSDEEP:384:j9adJPzcKTRQo4DDo4UBlXLP2NuEuGFP6ZvQMsY4bdn+FrBXDwlZL1yDDqOxJ/tL:g5zcKTKFD0rXKHBw/rSl1k31RaGXUm1
                                        MD5:C1AFBC88ED47F2FFF0C8B0E9C93F3B60
                                        SHA1:71EADE1D4D878BB80FE469D169EBDAED81342A23
                                        SHA-256:FC8EB93843F5D2933F409B4EB990F802B1127663FC1558BB50B9F016B05A7F1C
                                        SHA-512:FA4B918E81D56ED7A0220B4992DD9287A2F100E7FAE28294E5ED7EA488EE9F391070FB2D3B643F6A750857AFF64D74A769F0C867B416ABD8169CD7A70EF614DC
                                        Malicious:false
                                        Preview:.PNG........IHDR.............<.q...\.IDATx....U........kw..v..k\;...PP..AJD....E..D...*!(..X..8......}fo.....c?.{.>{..b.]_.7..b.......N..+.v.a...n..n..byyy...w.9..6..*U...u.]c{...w.m..g.......*V.h...o.......q,....e...[.9..~......;.......4........U...cu]..g.'...c....j...A.}..'..~..e.=.L.&...*T.....w.M.7>.3......;.h...>...|[.9...|........<_.r=...X.z...G....}u....O.....}.ca.....G.;.t.i}6X....{./.N.....v...OJ,....?w..u..i...%|'..o...%.,.g..}..C8...5r/....J,a7.s...[...w..L...za.0Z.y.S.i...A.*j...>'.......H+...xF.at.F.m.k.C...?`....^.mt....].D.X..g.}....J.......}IX.Q..... ..e.{K&.E..C.5..s.9.S.E.]dn...S.zuS.V-S.n].A.s.}..{...u.]..[o5.....Yg.e.;.8s..G.....G.gt..|....M.X..9Q.....&..L,}..}.W.....J.0:..F.....9.c....cG3|.p....3f....E............_~1../...._-x...~...\......3S.N5.>......W.......G.i%.d.:.r..L.>M.v..u.......1t.j....U}...N.......T.b...J.ys3v.X..G../.............@.H........l....O?5.g.6.f..9s...?..3.._.o......A..K........}_|.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\update.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):1580
                                        Entropy (8bit):7.778938064983873
                                        Encrypted:false
                                        SSDEEP:48:iB4tZ84cyC86IswaNFeUd9gcBTmPNv1K1z+t9MWDCU:3Z8DySIsbFeUd9lYU1yIWWU
                                        MD5:821FECA097D7DE35F0EE7D1C0AA03635
                                        SHA1:88803F1BBC066A6A6BE8722610AD3236F06E20BC
                                        SHA-256:D5A0ADA0CFA3837F27FB804582BD5F42AE60DD3A7EE58A51775EFAAC44A2C262
                                        SHA-512:0F6ED76BD84B055C7269367813D07235E7A77AEF70CBF9D1EFE9303ECF87C3BCE51384B25E50942BA233E957B14EAD51123E3786B23E763A90298C96583AE1F7
                                        Malicious:false
                                        Preview:.PNG........IHDR...d...d.....p.T....sBIT....|.d.....pHYs...........2F....tEXtSoftware.www.inkscape.org..<.....IDATx...]..e....3....;3J~`_d..D...9G[)*lSB."...... ........(....>......... J.#qf..7w..O........9s..].....g..y.}.@.!..B.!...i.=8.:....*..*.YY....G....L........%i.KC.7....~gU...+.......!.@i..l".....4.!.....e.m.C.. iH.DX..;{N..7.T.4$6.>\..w.6Q].......A.....x%......;.b;.......=.U^).VW....g...&.!......LY....p..b....;...6.V..h"ufl.JAo.B.!..~w...L.f..g....fPPqw.a..y.].X...1..z.....<...$.U.}B.~w%1..Y3.._[V...0t:.2-.......f\B..D3......w....."..]-v...w...X..t.i....6.^gi.lC.....*t.3.....;".v..6.#.7Z#...u#.4....b.j.:....7..cD..-..t...............jh.2.A.Y.E|y..k.......Q..W"..R.F.l..... .A..W...ot;r<.m.."W../.p.W...]:...".E.&..z....NDv.cI6cD!...........N.L.d./+ot..QHC.L...4d|.g.(.!....E....R._.Y3Fj(i.)m<v....C?f.^..B.!..B.!.hf....Vf....f.....D..g.36{. ...er.=.8.(.w+j.......P....uJ}O=.......3..<H.!A...@/dcl\..b..mA.......3...k..*|....Z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\wallet.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 49 x 44, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):824
                                        Entropy (8bit):7.558816816333435
                                        Encrypted:false
                                        SSDEEP:12:6v/7mYMC2s/6TbRBtTgRM0I6IlqsRt4CUMQL8rCeIlEm5SQlcjhZ0EtniYerognT:HO2s/6fRXHYODt4gQ8mDlcjdtAEIH
                                        MD5:61F57C284D23775E1D16EF041BB07A9D
                                        SHA1:8AA2AE436DD6365D8AE600DB715760C57EFDA20D
                                        SHA-256:BB8B3B769D9E22053F3DF5A842A48D21BE6E1659D4DBEF7E09F4AB5EAD7EF509
                                        SHA-512:A1EAEF3131A82563607C149421712E3E9262726442B6B62322F05B510010696943A296ADB3214CCD3B5DA3E1B5F6B1AD9F1473D7AFD80D7D1E132BEE5B251751
                                        Malicious:false
                                        Preview:.PNG........IHDR...1...,.......PY....gAMA......a.....bKGD..............pHYs.................tIME.......(x.*....iTXtComment.....Created with GIMPd.e.....IDATh..?h.A...7..O.1.R..!&.L'iD.(X....b.!D..l..L.&........A..J.0...X.B.d.....'......$.....m.WM1..1...f.;.6...6.m.QSJ.l.W...L....4.!....+`j.........h.3..<2.+..r...Z...F%..s}]O$,s..M.h..p....@r.l....%{........[....`L..6.....C...r....}'.....<.U.....;....5.N.s.&.6.0:.?.0..R.]+4.zb...J....)F&..v.Im...@..8l....`.a.....E......eo....b-.....P."Y....2NZfWU.....F...$.a..^..Nn.B.".O,.<.Z...&.MQ..9.Z...#)..$#...#d.S..a...-_Qt.j..J8...d..U3.T4..../C....2E.)mu.UM.......\....w..N.|7....A...6......a.#...`..>.)./..%........;..G....Q.C'..d..vt+1/\^.l.{B!.@.fk.%2@y.=...1D..C..1.!R..K........B....-.a+3qr...B...G....$...2Z.........8;5)~......Z`.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\warning.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 150 x 138, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):4839
                                        Entropy (8bit):7.937332736620083
                                        Encrypted:false
                                        SSDEEP:96:MKNL4/3sotYG4AcBAvnnuFuNIZY3gg95nqItMewv7EOWTbZwZxeTn08FunI:MKNM9tYB/BAfwY3dnqyMpv7BEa7eT0/I
                                        MD5:C1AE18250A3845EDC5E015F6FD7932C5
                                        SHA1:FA5FDFE17E4FB0A9F2CCAF4BDCC2FF75B34BC94A
                                        SHA-256:541AA0FFC78F1B11C16ABB5AFE51FA1465D383EC4D867981D6275838F526D0F1
                                        SHA-512:19726DF6BD213F4BE99C4EF0585901BFD0A2DF7A174F17B71D7D1FB733E8D6CED2A105090CEE71DDC0E9FAF3AF6DBA43F17D2E00F5255E2B2FBD209F867A1291
                                        Malicious:false
                                        Preview:.PNG........IHDR.............H.......bKGD..............pHYs...D...D...%.....tIME........)k...tIDATx..{x.U...U}IwB:.Iw.F ...`...P..../..#.xA...../(...".....0.....<..:..w.G.G..../,..(.-.N...A#.O.........?..>U....|...|.L.`.......h...[.e.`.D&..-...g+Pg...d..I..3.4..p.....T.>.M....+. .O.iF...E.R).F.&..o..K..4.i.`..Y&^.V^Z.UY..T.^fW#..IM.../.U.(.=......b.U.\We.A%.SL...k,.Z......../..0..:.F...F....m....%eT.m'...*..r.]{..j%.....F.3.T.E...'.!.s;n<.d..R....p..+.....ux}u9ng.g..ge..&>..I4LW.L..9X'j.4.C..v..-...].6r..+.0..[..G+"2N.C..Ia.GD......J.<"j...Bl.._....B..a.AdX.M&..j."\.;......)Q..Ua..".^.Mb.7..5.]X.G.Q.z..........x.X..Rc:.5.......G"...6....xF....x;.n..U....A../....f...+} .q..GuU.Zfd.....4=....X$...W`.._:...4|...b..x..X..zQ..S|.dkd...?......ez,.c,p}.Fg...k.!......M.......}.U.j.LH...........%...U.R.1A.rq&.9.....HUUn.1..\9....b.^..2 .0....6.Y-92.}....VQ..HCU>.=.JQ.Cr..;....3W4M..;.\...G*p...3U4MW....q...=Iz...Y}...0.m.6=..q.....?I2..h7hM....6.D&.>e....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\gui\icons\zoom.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                        Category:dropped
                                        Size (bytes):11786
                                        Entropy (8bit):7.957478228690459
                                        Encrypted:false
                                        SSDEEP:192:aekmXwVxRBdZ35KCHx2y4g4574thRlIUqh+4Nrv7YDOXOXxlbveDvfw2l:+bbdZ31HgPt574/RW5J7KOCzzivtl
                                        MD5:A93A6C2050830B2AED471A666DD5F52B
                                        SHA1:34DE9BB7EDA8B291820622089D5B4DDD3B8ED70A
                                        SHA-256:19E15596D401E2D0DC227F5DA3B04179555E449B1C6D7732514B336589D4D713
                                        SHA-512:91C96AAD3F90A786F60F3B3C323297BD0E7341ECB0AA47CC85E5E015DF3112CE97EDE28D74FB33D25854782918FAE1D3692B06BE6E07C5352D62BB3951198A2E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............>a...-.IDATx..]..SU...i...L.Q.20.^.E.ba.\u]u].-...ZVEWT.E....b[...DAPA.4.......{.L.....L..^&.e.9x.....w.{.=.^.zH..XK`-.."XS.\[kl...._u..#.p..t.R......k...)u..gl.Y...].......,..6...\Q#. |..W......]n..6.......B`X..*.\u........k....tg.$...-b.....K...Y{..1g.a.&.q...App0.....S.....6-.r...FMu...N......9....x......T...aD.q.....rr..Ov?.e-5-.j..1Y!j.<.......8..?....;w...m?.sN...GY;~........B...]]..<n.$..;......f;.........n...W....G..j.......v).`&kKY..wQ@@ .N..W....$Y.z....5w7.)YsS...(.....j0.....=...r .o/>\..|..'hnn._......xh...h...wQ4..7...L..Jx.Tf.(.1J%T^..Vy..........?..^.A...6.........._}....]}....q........?....$2.n...&N..www.Q...1.W...7...<?..t $.V.....V,7.....e.......3..A...n.Z..........a!....F....nn..q..?|......A.....&;.).L.n........ .CI.1j,...}...7.4b|p.?g.....Jk;......{.c..r..P..~....D.DC..&...F..........;3.4A.....v..$..R..2......-x.4x......v.'bK.|.gI...G.....S..i....1.pv...U.....i.....]...q...xT.<.-...3 ..`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\lnwire\onion_wire.csv

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):3121
                                        Entropy (8bit):4.799864332727764
                                        Encrypted:false
                                        SSDEEP:96:IzHLC9LgLZWLCALhG0Lro6euCNAQhqQWLeL9Lm:8eO2GWjNx
                                        MD5:E384DCF371DF1E40CE76874151812EDD
                                        SHA1:434042DC2F8ED57D203BF1B950091636A84EB37D
                                        SHA-256:2DDBC1FF1B9EC2E7D2E86E50147A3E61EE569D53E8E097633A61A7E18A9CDFA4
                                        SHA-512:DA43A8CAC8020AE237E0E3D9B6B91594E9C962F2F4FD05AFB92F242BC00C265A0D0798010F72985CFEC57962146E1C5D02BE59D7B944386617C5140AFC3B1E51
                                        Malicious:false
                                        Preview:tlvtype,payload,amt_to_forward,2.tlvdata,payload,amt_to_forward,amt_to_forward,tu64,.tlvtype,payload,outgoing_cltv_value,4.tlvdata,payload,outgoing_cltv_value,outgoing_cltv_value,tu32,.tlvtype,payload,short_channel_id,6.tlvdata,payload,short_channel_id,short_channel_id,short_channel_id,.tlvtype,payload,payment_data,8.tlvdata,payload,payment_data,payment_secret,byte,32.tlvdata,payload,payment_data,total_msat,tu64,.tlvtype,payload,payment_metadata,16.tlvdata,payload,payment_metadata,payment_metadata,byte,....tlvtype,payload,invoice_features,66097.tlvdata,payload,invoice_features,invoice_features,u64,.tlvtype,payload,outgoing_node_id,66098.tlvdata,payload,outgoing_node_id,outgoing_node_id,byte,33.tlvtype,payload,invoice_routing_info,66099.tlvdata,payload,invoice_routing_info,invoice_routing_info,byte,....tlvtype,payload,trampoline_onion_packet,66100.tlvdata,payload,trampoline_onion_packet,version,byte,1.tlvdata,payload,trampoline_onion_packet,public_key,byte,33.tlvdata,payload,trampoline_

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\lnwire\peer_wire.csv

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):10291
                                        Entropy (8bit):4.483106197219259
                                        Encrypted:false
                                        SSDEEP:192:IYxDifBpiEumGFA0OpJLGYYcRwaiGxyz47omSaIuGcByWyb3t:dVEHLGYj7lbIuxByWyb3t
                                        MD5:56A2D1E3978C5FA6512CD9A4AEE94E4E
                                        SHA1:E5343179EF2B850AD95956A1723B7191B4E800A3
                                        SHA-256:8BF80CAB57F38296474611AF11C116B34A93AECF8575F0164A9E886B335D2422
                                        SHA-512:7B3DDA9E17D6E1ADE902D807A17244FE4540063DFCBC12E65FECB183D9B9462812B18C0D73DC9926E00BCFD5D8342D7C588725D94ABB7425A98587DADDF88828
                                        Malicious:false
                                        Preview:msgtype,init,16.msgdata,init,gflen,u16,.msgdata,init,globalfeatures,byte,gflen.msgdata,init,flen,u16,.msgdata,init,features,byte,flen.msgdata,init,tlvs,init_tlvs,.tlvtype,init_tlvs,networks,1.tlvdata,init_tlvs,networks,chains,chain_hash,....tlvtype,init_tlvs,remote_addr,3.tlvdata,init_tlvs,remote_addr,data,byte,....msgtype,error,17.msgdata,error,channel_id,channel_id,.msgdata,error,len,u16,.msgdata,error,data,byte,len.msgtype,warning,1.msgdata,warning,channel_id,channel_id,.msgdata,warning,len,u16,.msgdata,warning,data,byte,len.msgtype,ping,18.msgdata,ping,num_pong_bytes,u16,.msgdata,ping,byteslen,u16,.msgdata,ping,ignored,byte,byteslen.msgtype,pong,19.msgdata,pong,byteslen,u16,.msgdata,pong,ignored,byte,byteslen.tlvtype,n1,tlv1,1.tlvdata,n1,tlv1,amount_msat,tu64,.tlvtype,n1,tlv2,2.tlvdata,n1,tlv2,scid,short_channel_id,.tlvtype,n1,tlv3,3.tlvdata,n1,tlv3,node_id,point,.tlvdata,n1,tlv3,amount_msat_1,u64,.tlvdata,n1,tlv3,amount_msat_2,u64,.tlvtype,n1,tlv4,254.tlvdata,n1,tlv4,cltv_delta,u1

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ar_SA\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 470 messages, Project-Id-Version: electrum ' (\331\204\330\247 \331\212\331\210\330\254\330\257 \330\263\330\271\330\261 \330\265\330\261\331\201)'
                                        Category:dropped
                                        Size (bytes):40209
                                        Entropy (8bit):5.39847839032353
                                        Encrypted:false
                                        SSDEEP:768:GNyUGMFYCcntm+dE+qCXwh75pLmi7KUOj:8yUvaFtm+a+FXw977ej
                                        MD5:1494DC7A2CCDB6723531124F3947D502
                                        SHA1:C08D9607B8E580961098617D482DE8DB7B02B7EE
                                        SHA-256:E75899862A93F97838047A8B8727B3B5267B7603FB95D522139D8906A723DF36
                                        SHA-512:D226B66A18711C6238888E85AEA87DCF937FFE4FD84D3D2B30575F19E5019D5A683B57036808BE43292B496B9575014683FD2338F913D1465CF2D5CD5FFEED36
                                        Malicious:false
                                        Preview:....................w...|.......X'......Y'......r'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......(.......(......$(....../(......:(......O(......U(......](......j(......r(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)....../)......8)......?)......F)......L)......T)......e)......k)......r)......y)..K....)..0....)..m....*..#...o*..=....*..)....*.......*.......+..0...)+..4...Z+.......+......2,.......,......>-......T-......c-......o-..'....-.......-.......-..-....-.......-......................%.......<.......V.......n................................................/......./......0/......9/......=/......P/......^/......y/......./......./......./......./......./......./..O..../..!....0......A0......J0......V0......k0..(...y0.......0.......0.......0.......0.......0.......0.......0.......1......!1......;1......N1.......1..c....1......^2......k2......v2......}2.......2.......2......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\az_AZ\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 771 messages, Project-Id-Version: electrum '(FX m\311\231z\311\231nn\311\231si \311\231l\303\247atmazd\304\261r)'
                                        Category:dropped
                                        Size (bytes):58340
                                        Entropy (8bit):5.4378098300492415
                                        Encrypted:false
                                        SSDEEP:1536:M0/NXoHgDJy7q3NtxmDTceC9Imp+JEsrOZYnDNr:M0doHgDJSYZmDTdC/yEZYDNr
                                        MD5:C2284BED2C683C241418DE2E9BAC03DC
                                        SHA1:AB19748E45F2F7F5C8A39578357577F34438D6F4
                                        SHA-256:73B02DF1ACB80E019790D0EEF7810824D12D1A94126F98964FBB9B5BE8AFEB1A
                                        SHA-512:FED3B40C623416342F65D0BBB98056E7903FE835C3192744B2CDD795B279FE0AC20929D5A021DF9012D0B3E66B8FE951D8C1935F962C52CF5C1DB000D8537243
                                        Malicious:false
                                        Preview:................4.......L0......h@......i@.......@.......@.......@.......@.......@.......@.......@.......@.......@.......A.......A.......A......&A......4A......?A......JA......_A......eA......mA......zA.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......B.......B.......B.......B......7B......>B......DB......LB......]B......cB......jB......qB..K...|B..m....B..#...6C..N...ZC..=....C..)....C.......D...... D..0...?D..4...pD..>....D.......D.......D.......E.......E......4E......@E......RE..'...bE..&....E.......E.."....E.......E..-....E......!F......)F......9F......KF......bF......pF.......F.......F.......F.......F.......F.. ....G......1G......;G......PG......eG......nG......rG......}G..0....G.......G.......G.......G..K....G......9H......TH..)...[H.......H.......H.......H.......H.......H.......H.......H..,....I......>I......LI......WI......]I..O...dI..2....I..!....I.......J.......J......&J......2J......GJ......\J..(...jJ.......J.......J..2....J......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\be_BY\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 92 messages, Project-Id-Version: electrum ' (\320\232\321\203\321\200\321\201\321\213 \320\262\320\260\320\273\321\216\321\202 \320\275\320\265\320\264\320\260\321\201\321\202\321\203\320\277\320\275\321\213\321\217)'
                                        Category:dropped
                                        Size (bytes):7945
                                        Entropy (8bit):5.513105300628986
                                        Encrypted:false
                                        SSDEEP:192:RU02G8iwCW/+lYnqnfPshcrkvk3n1z8/kp5:RUnValoBZcZBp5
                                        MD5:D802FD82602489E60AE6240A683B2F5F
                                        SHA1:39A5802D94B574CA55162A2B267370CF17859D97
                                        SHA-256:994ABEF1A0C908AB485F5B70C9E47A4322C5BB8FCA9DEF164BDD399C9CD26C73
                                        SHA-512:C8F3A78CC7316B4FA570BAF96BCF629F7EC54033566850AD491F0B7A71F740E62E58F5F57D3FCF4B0434741586ADC53E693437E12E0397DC55EFDF60048F6D08
                                        Malicious:false
                                        Preview:........\.......................................................................!.......4.......;.......J.......\.......u.......}...............................................................................................................,.......2.......<.......I.......O.......X.......f.......l.......{...........................................................................................................K.......m...P...#.......=.......)... .......J.......Y.......x...................................'...............-...........>.......F.......V.......h...................................................7...................(.......B.......M.......d.......n...............................................................6...!...T... ...v...........................0...]...................................;...................*...D...D...I.......................................................!...0.......R.......b.......p...........(...............".......!..................."...&...0.......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\bg_BG\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 492 messages, Project-Id-Version: electrum ' (\320\235\321\217\320\274\320\260 \320\275\320\260\320\273\320\270\321\207\320\265\320\275 \320\272\321\203\321\200\321\201 \320\267\320\260 \320\276\320\261\320\274\321\217\320\275\320\260)'
                                        Category:dropped
                                        Size (bytes):42246
                                        Entropy (8bit):5.368441980539918
                                        Encrypted:false
                                        SSDEEP:768:yF/P3MQQf+n89A7JNVw+slsjkmHy+i5+t4x4xi456m:i/z/173Vw+slsjkmS+vtNx55N
                                        MD5:00B223778C69AB4FC048BB5FD43B3F82
                                        SHA1:2F2AFAEC284A81DAA6969649E95E64D05DFA5801
                                        SHA-256:C3BF310DFEF83A751EBEB27BE91614D949F519E05C7681C38C313D1B6291E72B
                                        SHA-512:53154EA31A6C90F63E13C59D6157F4C9D83D879160C7DEB2E13AE6924E50E5BD387E4DE19093D5ADCF2E3ADEC2925437A4F458FA4B899A55DCF40BE0B5152BC6
                                        Malicious:false
                                        Preview:................|...............()......))......B)......P)......W)......b)......q).......).......).......).......).......).......).......).......).......).......).......*.......*......%*......-*......:*......B*......T*......]*......j*......w*......~*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......*.......+.......+......#+......*+......0+......8+......I+......W+......g+......m+......t+......{+..=....+..)....+.......+.......+.......,..0....,.......,.......,.......,.......,.......-.......-......&-......:-......R-......j-.......-.......-.......-.......-.......-.......-....................................../.......<.......N.......`.......f.......m.......v...2..................................................../......./......./......+/......./......./..c..../......A0......L0......S0......]0......y0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......1../....1......O1..!...]1.......1.......1.......1.......1.......1......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\bn_BD\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: electrum
                                        Category:dropped
                                        Size (bytes):592
                                        Entropy (8bit):5.281270234681264
                                        Encrypted:false
                                        SSDEEP:12:i4SxjCt0d+j/4GoMXmBQWivXmBQWii3bb43ZPqzJkTj8bpX:RojCt0d+7CMXmQXmHn699jA5
                                        MD5:AF41EA96475D4C651C984F0FAA00EACE
                                        SHA1:7FDAFF4F0224415031CC727383013F853052E4F3
                                        SHA-256:A4263EEDEC96E890B96B05E53AD3493FEED367BE5A2354AA5D8D498225F36AFC
                                        SHA-512:645A9EF2C05571B691BE5E1C39BBC7B9CA6C557C027EB47483075F7FAF832D97C94CA829A577DBF3A4EAFE8245B8B478CF42522BCF9DFDF2CDA2D296EE2CCA6A
                                        Malicious:false
                                        Preview:................$.......,.......8.......9................Project-Id-Version: electrum.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-05-29 13:38.Last-Translator: .Language-Team: Bengali.Language: bn_BD.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Qt-Contexts: true.Plural-Forms: nplurals=2; plural=(n != 1);.X-Crowdin-Project: electrum.X-Crowdin-Project-ID: 20482.X-Crowdin-Language: bn.X-Crowdin-File: /electrum-client/messages.pot.X-Crowdin-File-ID: 68..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\cs_CZ\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2246 messages, Project-Id-Version: electrum ' (\305\275\303\241dn\303\275 kurz k dispozici)'
                                        Category:dropped
                                        Size (bytes):206582
                                        Entropy (8bit):5.511387090624787
                                        Encrypted:false
                                        SSDEEP:3072:gl9ksbpAWHqCdhAmVw+slsiAiWrHoJ3muV2YE+wPuCTkIkwtR5NShwkyOm:gQXWHqehKQpGSkaShwnx
                                        MD5:D0822D2A2138562B216114A34F83CDBF
                                        SHA1:7CA24F6CCF2284EDAA645499ADC212E0B582BCAE
                                        SHA-256:EF68048E3FA875FA9F360BCE9AB0EF8AA468146E27BBFC83561B6D52A5C4EBE4
                                        SHA-512:411B230BC56F7C60C2916212F6B58B902214EAA64364784538699961D301D59D9A40A3797ED77F29574DC25F39D2C46BE63BC561203B621B3AC250607B669A65
                                        Malicious:false
                                        Preview:................LF......|.......X.......Y.......r.....................................................................................................$......./.......:.......O.......U.......].......j.......r..........................................................................................................................(...............C.......L.......S.......Z.......`.......h.......y........... ...............$......%..................(...............5...;...<.......x...K.......0......m.......#...n...........N...c...=.......)...................)...0...H...4...y...............Q...........L...]...>.......................0...........B.......R.......a.......t...................................................'.......,.......'...D...&...l...+.......*.......................3.......1...A..."...s...........-.................................................../.......=.......W.......s...................M...................%.......<.......\.......{...............................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\da_DK\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 362 messages, Project-Id-Version: electrum ' bekr\303\246ftelse'
                                        Category:dropped
                                        Size (bytes):24068
                                        Entropy (8bit):5.123170147625518
                                        Encrypted:false
                                        SSDEEP:384:aVOlbBh8d8kWA2tundlSum81W/S+TuRqLpoHKUBQpW8jD6:aYlbrGP73mtK+VWHT+D6
                                        MD5:6F58DFEC7DA500FDEC1F76327830E6DF
                                        SHA1:5E01F279C6EAA58D630020CFD5044ACD1908D1A2
                                        SHA-256:CA01E7A1404E6D6C7B676E978C03B606578566D5158EB3BC05275B10262F896D
                                        SHA-512:0448ADA8C149F180E73D5B8F1501588F9338F7DC57AF12F951A7EA7F3335E5F183C6698EFD914EF09C6216D343BD912AD812FD6207C31C1931E3508FA3860F5A
                                        Malicious:false
                                        Preview:........j.......l...............X.......Y.......g.......n.......y.......................................................................................................(.......0.......B.......K.......X.......j.......p.......z................................................................................................................ ....... ....... ..).... ......C ....... ....... ....... .......!.......!.......!....../!......G!......^!......z!.......!.......!.......!.......!.......!.......!.......!......."......."......."......%"......,"......4"......L"......V"......p"..c....".......".......".......#.......#.......#.......#..O...-#......}#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$......+$......2$......7$......<$......E$......M$......U$......\$../...h$.......$.......$.......$..f....$......-%..G...=%..1....%..-....%..4....%..4....&..K...O&.......&.......&.......&.......&.......&.......&.......&.......'.......'...... '......7'......?'......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\de_DE\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2440 messages, Project-Id-Version: electrum ' (Wechselkurs nicht verf\303\274gbar)'
                                        Category:dropped
                                        Size (bytes):245641
                                        Entropy (8bit):5.291673542604029
                                        Encrypted:false
                                        SSDEEP:3072:ChHmTj/tGcHVw+slsuTiMhsvFvlTK7gMV2YE+/28ULUC+kA+QNK/ABZwV/hDuhrt:ChGf/sOTdI2GFkuK/oyShbQHyN
                                        MD5:6482EF5714F22B88ED804F91863F77DC
                                        SHA1:5E255CED57F87FC97F1038B8CDF0DAC94BFAF5C3
                                        SHA-256:6CAADD4CFBF323E4E4C9E4D2EC150F15282D0BA221C132204C561F94E78FA4B1
                                        SHA-512:C7A41C9CE9F8792124CC5D8C43BFDD89446E2677DA47A2D7443645DCA7AE0270A0AEB7116178AD40703983135D59F7540E84FE4F2F2D9DEECE65D91FA82B8955
                                        Malicious:false
                                        Preview:................\L..............p.......q...............................................................................................................<.......G.......R.......g.......m.......u...............................................................................................................................'.......3.......@.......F.......[.......d.......k.......r.......x........................... ...............$.......%...........1.......@.......F.......M.......T...K..._...0.......m.......#...J.......n...N...?...=.......).......................0...$...4...U...............-...........L...9...>.......................0...........................=.......P.......h.......|...................................'.......,.......'... ...&...H...+...o...*.......................3.......1......."...O.......r...-...................................................................3.......O.......c.......{...M...................................8.......W.......n...............................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\el_GR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 283 messages, Project-Id-Version: electrum '&\316\240\316\265\317\201\316\257'
                                        Category:dropped
                                        Size (bytes):26844
                                        Entropy (8bit):5.416977634408204
                                        Encrypted:false
                                        SSDEEP:768:nzQwR9S0umfc+bkDaC5eEdw2rOnTodqiaTN1/y:7S0um0+I2C5eEOyOnTodqDTN1/y
                                        MD5:72AED5ADB5BE81C827BE0C57DF9234E7
                                        SHA1:17F7403EEFDC5AC07AEE4165E9C6E9702A159921
                                        SHA-256:A4F1C207B5C7F2EB130CFE42B8765E7C0DD58C933C572A4EF355B8465A0B4DE5
                                        SHA-512:365353D262181C0C4DE193F1829EB84E00206600F83B68F0DBDE2F281BB2725F3C5E0B96D70AFF428A9C34C921D750FF10375425F7896092EE814A5F0BCB294D
                                        Malicious:false
                                        Preview:....................{.........................................................................................../.......5.......=.......E.......W.......`.......m...........................................................................................................................)...........4.......................................................7.......R.......Y.......j.......w...................................c...........7.......B.......L.......].......a...O...h.................................................................................../...........I.......Q.......b...f...w...G.......1...&...-...X...4.......4...........................................).......<.......B.......Y.......p.......x...........................@...........................................!.......(.......-.......F...`...N...................!.......!.......R.... ......a ......m ....... ....... ....... ....... ....... ....... ....... .......!.......!....../!......8!..3...I!......}!.......!.......!......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\eo_UY\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 60 messages, Project-Id-Version: electrum '&Pri'
                                        Category:dropped
                                        Size (bytes):3829
                                        Entropy (8bit):5.050493676947178
                                        Encrypted:false
                                        SSDEEP:48:fyZTUdhzeww6wfHeEdb/C59pZwsNKvIpUIsKebV6epBjPd+Rvxa9djQfq+8x2NE+:fSYLzGeEK9Tw5vms+erLYtxAJT2N3+WF
                                        MD5:7A3B817DD4059ED942F2E6CD7BC14A7D
                                        SHA1:29743DB8B3829698A61A8AF1BD957F3A35B3EFAC
                                        SHA-256:A49DB02C6D4095191B9E51A79A13196C5D018BCE0F992C63355EA50867D9FDC8
                                        SHA-512:575096927022375D867B190E7B57560E5B7B52415BD11B4BEBB2A340C00A0B7F71EAF1B8139D464339E9CE5CE6786DCD8B787D2D44739336CA2C7E05D41A4174
                                        Malicious:false
                                        Preview:........<...........S...........(.......).......0.......?.......E.......K.......Q.......X......._............................... .......7.......>.......F...c...^.................................................................../...........7.......?.......G......._.......i.......o..................................................."...........:.......Q.......k...............................................................6.......T... ...g...............................................................................4.......9.......F.......O.......V.......].......d.......n....................................... .......%.......-...h...5...................................................................&...................................%...............4.......:.......?.......F.......P.......W.......\.......a.......k.......q.......v.......|...................................................................................................................................................4...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\es_ES\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1696 messages, Project-Id-Version: electrum ' (No hay tasa de cambio disponible)'
                                        Category:dropped
                                        Size (bytes):159552
                                        Entropy (8bit):5.181391923509779
                                        Encrypted:false
                                        SSDEEP:3072:1QGBGaN5+MVw+slsxbAx/d9JbhaE+fqJ/o1ExHFTIFIfweNt:1EaLIriQ/eaFUFITNt
                                        MD5:1BBE0A110E7B3B1F535062204835E6C3
                                        SHA1:3C1C7A66C2FE36CD5C4F2DB67FC51FB6576DABF1
                                        SHA-256:EE02D75E3CE4E737532D2519394795B4946820CB980D902AE48A0E5C67F50C62
                                        SHA-512:FC268322E33D4CEEB4C80A8BCE617BFFDBBE963FDE76B34F6EFB8F7AA86FBBCD43E1814A8F862A9A2A191089F56B2FB20BFC319C80E8AE1C501B252F7C2F25C5
                                        Malicious:false
                                        Preview:.................5.......j..........................................................................................%.......-.......3.......F.......T......._.......j...........................................................................................................................#.......).......8.......D.......Q.......W.......l.......u.......|...........................................................K.......0.......m...>...#..............N.......=......)...........X.......g...0.......4..............................L.......>..........'.......=...0...O................................................................'.......&.../...+...V...*.......................3......"...........'...-...7.......e.......m.......}............................................................./.......O.......n......................................... ...........1.......;.......P.......a.......s...................R..............."...................*.......4...7...G...O...........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\fa_IR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 356 messages, Project-Id-Version: electrum '\331\205\330\252\331\206'
                                        Category:dropped
                                        Size (bytes):32361
                                        Entropy (8bit):5.452367310516809
                                        Encrypted:false
                                        SSDEEP:384:s9buWXsKTlUPOlkTeV/aMW/7Ngb5Dn+LCBC/3oOIUo/iRVrXT1KYflepCC66MW54:QbLsPGlidZgbJnHC/YIMYfUpOL1/KCd
                                        MD5:84DF714F097778B80603118AFD92F633
                                        SHA1:0ABB264116F103FA327086700541F2CBA6890606
                                        SHA-256:DC4137658BF566AE88FAE134796E079633C905F34B1DC6594DDFC01BE31F8802
                                        SHA-512:300F6FB87EB34D9A3B1A2F92ECE04BA3996F38D47C23B7EF02571F0234A71F1F34B253DDB7398D15ACBCBA96DECA84CDF039E4370D17A0089A6B2C87E8A0D9AB
                                        Malicious:false
                                        Preview:........d.......<.......\.......................................................%.......,.......;.......M.......f.......n.......t.......................................................................................................................'.......-.......6.......D.......J.......Y.......e.......r.......x...................................................................................K.......m.... ..#.... ..=.... ..).... ......(!......7!..0...V!.......!......*"......."..0....".......".......#..'....#......@#..-...P#......~#.......#.......#.......#.......#.......#.......#.......$......&$......0$......E$......N$......R$..7...e$..O....$.......$.......$.......%..)....%......G%......c%......t%.......%.......%.......%..;....%..,....&......-&......;&......A&..O...H&..o....&..2....'..!...;'..K...]'..1....'.......'.......'..9....'..8...2(......k(......w(.......(..(....(.......(.......(..`....(..b...>)..2....).......).......).......).......).......*......#*......**......4*......N*......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\fr_FR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1477 messages, Project-Id-Version: electrum ' (Aucun taux FX disponible)'
                                        Category:dropped
                                        Size (bytes):141467
                                        Entropy (8bit):5.2063635348502
                                        Encrypted:false
                                        SSDEEP:3072:oqT+SQiEN9Vw+slsRyAY042E+LO5CkeIyhhK5gQQ0Prk49+MTtITk2dUj3Frj:oKSr3vGleIyhhK5gQQ0ghMTtITk2dO3R
                                        MD5:D221DA3352EF268F7549FFACCA638E51
                                        SHA1:41B31D73EC65D89F817658C6F5A9EF799FD65FBD
                                        SHA-256:9A511D167739C42C7377E0ED5B8E7B28B2BF39BB41FB297EDD726854B7505628
                                        SHA-512:FCA7FAE172CCAF3ECE4EBD888EEA8F46B3C9840F0D5D040B81C56F8D1854892E253DFF1D012EACE5B6EE215BD76B80AEAD9649B1932B2EBDB17DC6100B9A718F
                                        Malicious:false
                                        Preview:................D.......l\......@{......A{......Z{......h{......o{......z{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......|.......|......"|......7|......=|......E|......R|......Z|......l|......u|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......}.......}......$}......-}......4}......;}......A}......I}......Z}......`}......g}......n}..K...y}..0....}..m....}..#...d~.......~..N...Y...=.......).......................0...>...4...o...............G..........>...S...................0..........................................5.......D.......P...'...b...,.......&.......+......*...........5.......D...3...X..."...............-..................................................<.......V.......j.............................................................5.......Q.......m..........................................................R...........Q..."...U.......x...........0......................7......O...........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\he_IL\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1278 messages, Project-Id-Version: electrum '(\327\251\327\242\327\250 \327\224\327\236\327\250\327\224 \327\234\327\220 \327\226\327\236\327\231\327\237)'
                                        Category:dropped
                                        Size (bytes):129718
                                        Entropy (8bit):5.302530802003399
                                        Encrypted:false
                                        SSDEEP:3072:LzVCwr63GY/6Vw+slsbk4BLffJGk6EljuvqjVSgiIJH1coGUSKs:LxCGLB/SvqjVSgiIJH1coGUSKs
                                        MD5:F426144F3140FF0891A6CB259DC0C04D
                                        SHA1:B14E12AFF5FFC3E4F9F096DD03602C54B11D6548
                                        SHA-256:CDC2266B6E2205792C402118B14F20B592ECD6FE1259DA81826F74A79797F495
                                        SHA-512:357B5DEF996409119409E451FE6E8C9EC852FEADD8E649936D53ADA64FA17876CC4FB0FB59DAB9CCAAB3EB6E56FE4E7B5CE25DD10ABE8BEC6F5AB99A30394849
                                        Malicious:false
                                        Preview:.................(.......O.......j.......j.......j.......j.......j.......j.......j.......k.......k......7k......?k......Ek......Sk......^k......ik......~k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l.......l.......l......*l......6l......Cl......Il......^l......gl......nl......ul......{l.......l.......l.......l.......l..=....l..)....l.......m.......m..0...8m..4...im.......m......An.......n......Mo..0...co.......o.......o.......o..'....o.......o..-....o......(p......0p......@p......Rp......ip.......p.......p.......p.......p.......p.......q.......q......7q......Sq......oq.......q.......q.......q.......q.......q..R....q......-r......1r..7...Dr..O...|r.......r.......r.......r..)....r......&s......Bs......Ss......`s......rs.......s..;....s..,....s.......t.......t...... t..O...'t..o...wt..2....t..!....u..K...<u..1....u.......u.......u..9....u..8....v......Jv......Vv......kv..(...yv.......v.......v..`....v..b....w..2....w..0....w......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\hu_HU\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2437 messages, Project-Id-Version: electrum ' (ismeretlen \303\241rfolyam)'
                                        Category:dropped
                                        Size (bytes):246841
                                        Entropy (8bit):5.44158151251534
                                        Encrypted:false
                                        SSDEEP:3072:/qwjl1JhdB9vdwv7tGcHVw+slsuTiMasvFvlTK7gMV2YE+/28ULUC+kA+Q4Exavn:/qwjphdBJdQsOadI2GFkxEipwRI
                                        MD5:FD7AD09DCB5122A07279390F0D5AD68C
                                        SHA1:B51F5F4A75E550E990111C6187FE33CAC724C603
                                        SHA-256:937DDA85E3B8C9FFA69E39822EFB146626F3F7BFFF751632F2DF9FE261C3BB2E
                                        SHA-512:A3DAABD56B23D3BF3E705F3CC52594BAAF046A3EDC58148377D3DCC92F68605D089F8691D62A85AA5870A40520AE053CC64C2B0A07641CA71F6D42E03BD2DD43
                                        Malicious:false
                                        Preview:................DL......l.......8.......9.......R.......`.......g.......r......................................................................................................./.......5.......=.......J.......R.......d.......m.......z.......................................................................................................................#.......,.......3.......:.......@.......H.......Y.......g... ...w...........$.......%...............................................K...'...0...s...m.......#...........6...N.......=...V...).......................0.......4...........R...............~...L.......>...N...................0...........................................0.......D.......V.......e.......q...........'.......,.......'.......&.......+...7...*...c...................3.......1......."...........:...-...J.......x.......................................................................+.......C...M...c...............................................6.......L.......h...............

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\hy_AM\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 267 messages, Project-Id-Version: electrum '&\325\204\325\241\325\275\325\253\325\266'
                                        Category:dropped
                                        Size (bytes):17891
                                        Entropy (8bit):5.359619489859007
                                        Encrypted:false
                                        SSDEEP:192:nPJ4gzC+TYMptKHeYpgPuGsYCMXrm976D459sxswzJZu6I3YqCP8BmXq8oze+hg:nPJLkh+YqPuww9m1mwjMfCEBzeQg
                                        MD5:823ED8CB1EF76B5F7B9A9449B9A9878D
                                        SHA1:C993359901DB6F5826BC7602DF715CFE63354E48
                                        SHA-256:5BE972A5768E6AC24FF3BAF96F7E371A91A8FD5E689C6EF187A473F67B0C5499
                                        SHA-512:41B63C92CA46FE7E14491C9D19EE2F257CCCC67519D46BBFB795F9E23FFD9FFEA4086552C8F254D9003E1B2A9F016334A52BF9D63C24B6D9EB8874E3F0950A77
                                        Malicious:false
                                        Preview:................t...g...........h.......i.......p.......{.......................................................................................................$.......-.......:.......L.......R.......\.......i.......r...................................................................................................)...........................................................................!.......=.......X.......u.......|...................................................................................c...........................%.......A.......R.......[......._.......f.......w...........................F.......O...).......y.......................................................................................................;.......Y.......h.......z...............................................................................................................,.......7.......G.......Z.......`.......w.......................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\id_ID\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 911 messages, Project-Id-Version: electrum ' (Tidak ada FX rate yg tersedia)'
                                        Category:dropped
                                        Size (bytes):75661
                                        Entropy (8bit):5.1311943163205065
                                        Encrypted:false
                                        SSDEEP:1536:nCsfOMuzD/e14Z9XsVw+slsD4+RKBiiJF8KmeE+iBdeqdkJ2OEnZe4PoPa:MleQsVw+slss+RFiJFDE+iBoq0EZUa
                                        MD5:24781CA0E413CE5548C60E5FA503F8A2
                                        SHA1:B72E761B1823CD92890FABB4C84D853FEB167C8A
                                        SHA-256:2B7A94D4254A9475744D8B55B144352D6F4D2A19F634C7DB7AA674E18123FDFB
                                        SHA-512:5A10AAF6BFF7D0AFC48C4C97D07161FA980FD5212D49501FE15FCB88DAFDC4A2D7E8F71FFF36568EFC2CC3E3DC4B70CD4CED6DB9F2A42AC666BAB271450F13BB
                                        Malicious:false
                                        Preview:.........................9.......L.......L......*L......8L......?L......JL......YL......lL......sL.......L.......L.......L.......L.......L.......L.......L.......L.......L.......M.......M.......M......"M......*M......<M......EM......RM......dM......jM......tM.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......N.......N.......N......#N......*N......1N..K...<N..0....N..m....N..#...'O......KO..=....P..)...ZP.......P.......P..0....P..4....P.......Q.......Q......DR.......R.......R.......R.......R.......S.......S..'...,S..*...TS.......S..-....S.......S.......S.......S.......S.......S.......T......0T......HT......_T......uT.......T.......T.......T.......T.......U.......U...... U......1U..R...:U.......U.."....U.......U.......U..7....U..O....V......cV..K...qV.......V.......V..)....V.......W......%W......6W......CW......UW..'...dW.......W.......W..;....W..,....W......&X......4X......?X......EX..O...LX..o....X..2....Y..!...?Y..K...aY..1...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\it_IT\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1518 messages, Project-Id-Version: electrum ' (Nessun tasso FX disponibile)'
                                        Category:dropped
                                        Size (bytes):141299
                                        Entropy (8bit):5.153426464246187
                                        Encrypted:false
                                        SSDEEP:3072:ImNgF5MOxOC8Vw+slsxM4ZD0JsHJE+YEUCkqHZp8tHKsSx26EMfM3lj+:ImNgFBOJx29lqHZpaHOx28M3lj+
                                        MD5:A2E20A145C77D9B7F46978936FFEB057
                                        SHA1:940C9292626ABB3279FCB65D637D5521FF3D2D82
                                        SHA-256:3F40E5B7DA4AB37A3416120AAA11BFA4713BD33B4BD73685ADEDE186F1AAB45B
                                        SHA-512:3D23BB1A976CF75D677BDBB890EBBF21840C175E3186372DC8E775700E801DB368AB81576398DD6F1132EB347E405DFEACBA26A5A6B6A13D0109EA2522391208
                                        Malicious:false
                                        Preview:................./.......^.......~.......~.......~.......~.......~.......~.......~..............................,.......E.......M.......S.......f.......t....................................................................................................................... .......&......./.......=.......C.......R.......^.......k.......q..................................................................$.......................................K...$...0...p...m.......#...........3...N.......=...S...)......................0......4...........O..............{...................0...&.......W.......g.......v...........'.......*..............................-...........H.......P.......`.......r.....................................................!.......7.......S.......n.......................................................R...........d..."...h...........................7.......O..........D.......R.......m...)...t.................................'..................1...;...C...,...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ja_JP\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1634 messages, Project-Id-Version: electrum ' \357\274\210\346\263\225\345\256\232\351\200\232\350\262\250\343\203\254\343\203\274\343\203\210\345\210\251\347\224\250\344\270\215\345\217\257\357\274\211'
                                        Category:dropped
                                        Size (bytes):176923
                                        Entropy (8bit):5.9253117816293015
                                        Encrypted:false
                                        SSDEEP:3072:aXgzctoePNMjYy6iT8Vw+slssX4YohlJs+HE+27qCx5kdVoXFz+YL6CVI2VkW:7zcoKNkYcIXqW45yol/VVVB
                                        MD5:024242E28294EDB37790E74AA962F511
                                        SHA1:1C26EDB0D81DB5C1F4FE9D3894209A9F75ED2107
                                        SHA-256:72DD9C12AF601E83D9EAAD89D5D65263236801B7775F4FAE0494B008921DE4EB
                                        SHA-512:AE71DCE9E5B2548DA6006C29308988C90A2284696647927E4819CEE36E662203CD606070010B97743C73E6DBACFFD21533A6DC09F1C48F223F98740131144542
                                        Malicious:false
                                        Preview:........b.......,3......<f......H.......I.......b.......p.......w...................................................................................................*.......?.......E.......M.......Z.......b.......t.......}...................................................................................................................(......./.......6.......<.......D.......U.......[.......b.......i...K...t...0.......m......#..._...........=...T...)......................0......4...........P..............|...................0...'.......X.......h.......w...........'.......*..............-...........&...............>.......P.......g.............................................................1.......L.......h.................................................R..........B..."...F.......i.......}...7.......O..............K...&.......r...........).............................................'...........A.......`...;...r...,.....................................O.......o...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ko_KR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 867 messages, Project-Id-Version: electrum '\355\231\230\354\234\250 \353\241\234\353\224\251 \354\213\244\355\214\250'
                                        Category:dropped
                                        Size (bytes):75023
                                        Entropy (8bit):5.901271857703765
                                        Encrypted:false
                                        SSDEEP:1536:Jc/RGw2g92W1Ja60lsw2cqnVx2mTE+e7q8JmoZWF4W4QYJbzAwm:aRv9px0lsjxZE+e71e8b0
                                        MD5:899DEC32465CAC98DEF58553834D90F9
                                        SHA1:473A96E570298820E6D2E735820CAB4F8DBBA924
                                        SHA-256:7A550F47402D2331CEC681096DEF7EB4991348B88776E4B8E87158ED921DF5CE
                                        SHA-512:0ED88F1140591C483B268A961C0BCE581C76C6E310A12F5C75F267B6848BB8BD12E29EF60BD79BE06FD4D4AD36E972C553208732981DD84142376A045E6D365F
                                        Malicious:false
                                        Preview:........c.......4.......L6......xH......yH.......H.......H.......H.......H.......H.......H.......H.......H.......H.......I.......I......#I......6I......DI......OI......ZI......oI......uI......}I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......J.......J.......J...... J....../J......;J......HJ......NJ......cJ......lJ......sJ......zJ.......J.......J.. ....J.......J..$....J..%....J.......K......*K......0K......7K......>K..K...IK..0....K..m....K..#...4L......XL..N...)M..=...xM..)....M.......M.......M..0....N..4...?N......tN.......O.......O......#P......9P......HP......TP......fP..'...vP..,....P..'....R..&....R..+....S..*...FS......qS.......S..3....S.."....S.......S..-....S......)T......1T......AT......ST......jT......xT.......T.......T.......T.......T.......T.......U......0U......MU......WU......lU......}U.......U.......U..R....V.......V.."....V...... W......+W..0...5W......fW......zW..7....W..O....W..2....X......HX..K...VX.......X.......X..)...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ky_KG\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 146 messages, Project-Id-Version: electrum 'Electrum &\321\202\321\203\321\203\321\200\320\260\320\273\321\203\321\203'
                                        Category:dropped
                                        Size (bytes):8631
                                        Entropy (8bit):5.4026184165113325
                                        Encrypted:false
                                        SSDEEP:192:IHpljx5rtqkI8OHDLsxsAdzaP6y6YjSmQXXJE:IHpSr38mAduKySa
                                        MD5:FD4E26CD008062111CF392271CBC163F
                                        SHA1:AF3963C8D5ECB183CE6D85467B9B6AE27F7821E9
                                        SHA-256:45186F9740141BF08B5DE60E68CEA2A14550D0E17718F8DFD97B001E2F2B0315
                                        SHA-512:AFB7E3BC32FE52A06DC322399900B5BA79DAE906FA89D763D3C3AA2446291412C9A03121923AA64CA68BE87330D750374D9D1405764F1FBC5B5A7F0A219AE4A8
                                        Malicious:false
                                        Preview:........................<.......P.......Q.......X.......g.......o.......u...............................................................................................................................................0.......H......._.......{.......................................................................................................................-.......2.......9.......E.......T.......Z.......q...........................................!.......!...........................).......@.......[.......o..........................."................................... .......7.......?.......X.......p...............................................................................&.......2.......H.......a.......m.......................................................................7.......>.......M.......j...........................................................................)...........<.......Q.......k.......t... ...~... ...........................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\lv_LV\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1215 messages, Project-Id-Version: electrum ' (val\305\253tas kurss nav pieejams)'
                                        Category:dropped
                                        Size (bytes):101644
                                        Entropy (8bit):5.348761988834637
                                        Encrypted:false
                                        SSDEEP:3072:FleSJ5oj+2GN4PVE+MjA6uhB2n0SrJ/IcH3vb:3jFZBjA6uhQnTlV3T
                                        MD5:AF4E0692C53045AFAFE1A35DF9650156
                                        SHA1:2EC5DB769D808ACB5CB0F31DA2329FBF11576BA6
                                        SHA-256:D72B733DA0170875CCE585C1D319B76558D514762ABB761C82A12F92080498E5
                                        SHA-512:CD4D20532AAB85EC428D78C3126354C2F0D55550065EE58381FA4C0648D630C2610A684A1DE388FFF7E1A458E2DBAA8269EFAE2C9A7ACF5BD5D0B967E7724832
                                        Malicious:false
                                        Preview:.................&..U....L......`e......ae......ze.......e.......e.......e.......e.......e.......e.......e.......e.......e.......f.......f.......f......$f....../f......Df......Jf......Rf......_f......gf......yf.......f.......f.......f.......f.......f.......f.......f.......f.......f.......f.......f.......f.......g.......g.......g......1g......:g......Ag......Hg......Ng......Vg......\g......cg......jg..N...ug..)....g.......g.......g.......h..0....h.......h.......h.......h..'....h..*...&i......Qi......`i......ti..-....i.......i.......i.......i.......i.......i.......j......#j......:j......Zj......qj.......j.......j.......j.......j.......j.......k.......k......2k......Dk......Xk......ak......ek......yk..7....k..O....k.......l.......l......7l......Hl......Ul......gl..'...vl.......l.......l.......l.......l.......l..o....l..K..._m..1....m.......m.......m..9....m..8...4n..(...mn.......n..`....n..b....o......eo......to.......o.......o.......o.......o.......o.......o.......o.......o.......p......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\nb_NO\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 527 messages, Project-Id-Version: electrum '%d bekreftelse'
                                        Category:dropped
                                        Size (bytes):38324
                                        Entropy (8bit):5.121849184747568
                                        Encrypted:false
                                        SSDEEP:768:qytoF/bPv+xN0Vw+sls21VAmb5++q6wuXEjI0OBnRwcEAHRJNob:MF/bP2xN0Vw+sls21VAmt+X3RAHRwb
                                        MD5:1B6F1AA21E121DA0256F56747C6F5653
                                        SHA1:5C55BD56D5CD4CFD7040F46FEA52C47390DA52AE
                                        SHA-256:92AA6465F6BCA3E0BA889D7B1B83D19E6E0FD426A3BB9BC733DEB195556AE79A
                                        SHA-512:0C40B89A270EE9594AC92505D01FC3B50424DC04769FBDE7AD516B0BEEDF05CA58AEECC22ABE615479AF4AB82DA110DAFFE5C5C36E30DD747EE9228939064EFB
                                        Malicious:false
                                        Preview:.........................!...... ,......!,....../,......6,......E,......^,......f,......l,......z,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......-.......-.......-......)-....../-......;-......A-......V-......]-......d-......l-......r-......y-.......-..=....-..)....-.......-..0...........3..............._/......u/......./......./..-..../......./......./......./......./.......0......'0......?0......V0......r0.......0.......0.......0.......0.......0.......0.......0..K....1......Q1......l1..)...s1.......1.......1..'....1.......1.......2..;....2..,...P2......}2.......2.......2.......2..O....2..o....2..2...c3..!....3..K....3..1....4......64......?4..9...S4..8....4.......4.......4.......4..(....4.......5......-5..`...85..b....5.......5.......6......%6......16......>6......K6......P6......a6......w6.......6.......6.......6.......6.......6.......6.......6.......7.......7.......7.......7.......7.......7..c....7......K8......X8......c8......n8......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\nl_NL\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2430 messages, Project-Id-Version: electrum ' (Geen FX-tarief beschikbaar)'
                                        Category:dropped
                                        Size (bytes):234575
                                        Entropy (8bit):5.199330625751406
                                        Encrypted:false
                                        SSDEEP:3072:CI9dUgY6tlcVGcHVw+slsubDMHsvFvGTK7gMV2YE+N28ULUC+kA+QK0jycOmaX3Q:bfLtSEP/oU2GFk1Uy0ano6yCm
                                        MD5:8314726B9C001EC0724E6890604EAD0A
                                        SHA1:434806DB9C7BD5100ADC7C3E9AAC8AB134FC377B
                                        SHA-256:C66670AEA6734CB78C87F1EF331E8FC74CE1498D15305D74CEA1874EF0B1510A
                                        SHA-512:79D57B13455F04AD566DBB6A85CC5B48020BDDF030F90C2C9E239692BD383194065000F9016F6081F738DE7C23437FD69ACE9868CCC795FEAA76FB1E916AE90C
                                        Malicious:false
                                        Preview:........~........L......................................................................$.......+.......:.......L.......e.......m.......s.......................................................................................................................0.......6.......@.......M.......S.......\.......j.......p................................................................................................... ...........(...$...>...%...c...........................................K.......0.......m...4...#...............N.......=.......)...$.......N.......]...0...|...4...............................L.......>...................3...0...E.......v...........................................................................'...#...,...K...'...x...&.......+.......*...................-...3...A...1...u..."...............-........................... .......2.......I.......c.......q...................................M...........A.......Y.......p.......................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\pl_PL\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 738 messages, Project-Id-Version: electrum ' (Kursy waluty niedost\304\231pne)'
                                        Category:dropped
                                        Size (bytes):58262
                                        Entropy (8bit):5.323465295409492
                                        Encrypted:false
                                        SSDEEP:1536:K/Rg/KLOL+Vw+slsDaWhZKmkE+pOqyfqUwvRDvQ:n6OSVw+sls2W6E+pOqoqUYDvQ
                                        MD5:6779F95AC63286787CAE9A70F6AFF9A1
                                        SHA1:92D6DD0102FDA7D04C3F999CA300B098848A2E5A
                                        SHA-256:767E40167F2D42FD788A6C5AFD7E2A40AFB4C2AF95B2F24625F49488DFBF0999
                                        SHA-512:D5DA017876619664DA829080EB1F9BF330CB4C4A3DEECEEAFAD8B34F81C2693CB1A8B31735D2A7E7FAD3C0A816D66B31A3CB6C2C6519E6850B4FF2C6C36AF462
                                        Malicious:false
                                        Preview:................,.......<........=.......=.......=.......=.......=.......=.......>.......>.......>......->......F>......N>......T>......b>......m>......x>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......?.......?.......?......$?......*?......9?......E?......R?......X?......m?......v?......}?.......?.......?.......?.......?.......?.......?.......?..K....?..m....@..#...|@..=....@..)....@.......A.......A......6A.......A......bB......xB..0....B.......B.......B.......B.......B..'....B...... C..-...0C......^C......fC......vC.......C.......C.......C.......C.......C.......D.......D......9D......VD......`D......uD.......D.......D.......D..7....D..O....D....../E......=E......XE..)..._E.......E.......E.......E.......E..;....E..,....F......4F......BF......HF..O...OF..o....F..2....G..!...BG..K...dG..1....G.......G.......G..9....G..8...9H......rH......~H.......H..(....H.......H.......H..`....H..b...EI.......I.......I.......I.......I.......I.......I......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\pt_BR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2257 messages, Project-Id-Version: electrum ' (Sem a taxa FX dispon\303\255vel)'
                                        Category:dropped
                                        Size (bytes):216445
                                        Entropy (8bit):5.257912655777451
                                        Encrypted:false
                                        SSDEEP:3072:xAoMUvjIlfATQ07bc6Vw+sls6ZAD5svJ9HKiV2YE+YvSCCKk4AQxCjMSbMW5JXlo:ZMHIbVSkvvHkxMssJb
                                        MD5:C0614F37AF1748C10319717E24399728
                                        SHA1:FE131240E84BDB77C0D312C6A01FAE3787FDE852
                                        SHA-256:BB055688994505A3C8F847E08F8744DAD7CEB3511A827942F1401C902DF04662
                                        SHA-512:52ABD58A62E1AF7273CB89F17A15C6F4F8A72EC5D042D3F94F9E8262F0407262F551B3E98C9E25FCBCE446B90400894EE6A4E9C3854FBB8759DACF9A6FC8B3DE
                                        Malicious:false
                                        Preview:.................F......,.......8.......9.......R.......`.......g.......r..................................................................................................../.......5.......=.......J.......R.......d.......m.......z..................................................................................................................#.......,.......3.......:.......@.......H.......Y... ...i...........$.......%.............................................K.......0...e...m.......#...........(...N.......=...H...).......................0.......4...........D...............p...>...........2...0...H.......y...........................................................'.......,...(...&...U...+...|...*.......................3......."...*.......M...-...].......................................................................*.......>.......V...M...v.......................................2.......I......._.......{...........................'............... .../.......P.......Z.......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\pt_PT\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 978 messages, Project-Id-Version: electrum ' (Sem a taxa FX dispon\303\255vel)'
                                        Category:dropped
                                        Size (bytes):74522
                                        Entropy (8bit):5.180723648720087
                                        Encrypted:false
                                        SSDEEP:1536:IRiZv013PB4rLdfmw+slspjB7AnwG2m+PXE+r0EtkkbGWbRr7rHG8S:I2/dOw+slsRB7z3E+r0EtIWdHrHZS
                                        MD5:5C6CB71E34A82965C2312A6DCF44864B
                                        SHA1:5B6CEBD1B344FED9B5AA206072FDF6A6A27C5D22
                                        SHA-256:F440E710F841264DCE5F9513853621389E1019EFB4DBADD98230C7B37F9B41A6
                                        SHA-512:CA078954301BF5270CF3C93C062A9CB314E80B311E88B701BD0BA97FE05CEA8EA3B63690D9A4FDD82F49BF272F8214ED5BCA7CFE049C1158F188A1F378DE7CC0
                                        Malicious:false
                                        Preview:........................<=.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......R.......R.......R......,R......ER......MR......SR......fR......tR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S.......S......&S......,S......5S......CS......IS......XS......dS......qS......wS.......S.......S.......S.......S.......S.......S.......S.......S.......S.......S..K....S..0...-T..m...^T..#....T.......T..N....U..=....V..)...NV......xV.......V..0....V..4....V.......W.......W......8X.......X.......X..0....X.......Y......$Y......3Y......?Y..'...QY......yY..-....Y.......Y.......Y.......Y.......Y.......Y.......Z......*Z......BZ......YZ......oZ.......Z.......Z.......Z.......Z.......Z.......Z.......[..R....[......l[......p[..7....[..O....[.......\.......\......4\..)...;\......e\.......\.......\.......\.......\.......\.......\..;....\..,...-]......Z]......h]......s]......y]..O....]..o....]..2...@^..!...s^..K....^..1....^......._..9...._..8...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ro_RO\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 482 messages, Project-Id-Version: electrum '(Nu este disponibila rata FX)'
                                        Category:dropped
                                        Size (bytes):38327
                                        Entropy (8bit):5.161015437615511
                                        Encrypted:false
                                        SSDEEP:768:pxqsV6JiI4DD92nk6KmWRE+AoQCT+cxsKuuwg7E1HcN5ir:zqsUJ8DB2nk6KmeE+A1CKcWKV5ir
                                        MD5:D12B71D6FCC559E90C4D9094C82000CC
                                        SHA1:A23BD3FEC73D2E73612C0D121A4B2B57A7E827C6
                                        SHA-256:70A55DF48932FDD8DF1D34CA83F4818DA51D7EC823338596FA66A844259C0006
                                        SHA-512:E3DC3BC241DD7A3B36A83B84863E4D2C4FFE31A2D0FEC0940CC4F56652C85B8A8A0BC2B04C94517DC7D1853C93B869B6E3567C03D00B5024E0949D461BAB873E
                                        Malicious:false
                                        Preview:................,.......<.......H(......I(......b(......p(......w(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)......$)......1)......9)......K)......T)......a)......s)......y).......).......).......).......).......).......).......).......).......).......).......).......).......*.......*.......*.......*......,*......2*......9*......@*..K...K*..m....*..#....+..=...)+..)...g+.......+.......+..0....+.......+.......,.......-......2-......A-......M-..'..._-.......-..-....-.......-.......-.......-.......-..............$.......@.......[.......w...................................!.......1............/......(/......3/......8/......@/......X/......b/......|/.......0..c...(0.......0.......0.......0.......0.......0.......0.......0.......0.......0.......1.......1....../1..F...^1..O....1.......1.......1.......2.......2.......2.......2......%2......92......K2......X2......m2.......2..=....3......N3......}3.......3.......3.......3.......3.......3......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ru_RU\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1443 messages, Project-Id-Version: electrum ' (\320\232\321\203\321\200\321\201\321\213 \320\262\320\260\320\273\321\216\321\202 \320\275\320\265\320\264\320\276\321\201\321\202\321\203\320\277\320\275\321\213)'
                                        Category:dropped
                                        Size (bytes):168884
                                        Entropy (8bit):5.472677280462419
                                        Encrypted:false
                                        SSDEEP:3072:E9A/9IgZzctVw+slsR7oJkXJeNE+GQnCN5FgfAhikQRWYtoIi8KOZZtCwbEAApD:E9AtRZyvkG5efNkxc99KOZZUwbEAApD
                                        MD5:C8C83E0856A67E7C0FFFE84123700342
                                        SHA1:A7D4F1430FDCB365B2553DFDDF1E7C476911FE30
                                        SHA-256:E1D1D95D10ABE73EF8E40BD9A8712560E399F95FCD9EA3E6E5221E973AAEDE8E
                                        SHA-512:FE614BB12F73872FB4D5B958F47449AEC99EAE39A64703E777EAEEB65D34045DC3D0163EB25FD0C99A92356D9AAEA2DC7AEAA39B112440B260233DA614E8DB51
                                        Malicious:false
                                        Preview:................4-......LZ......xx......yx.......x.......x.......x.......x.......x.......x.......x.......x.......x.......y.......y......#y......6y......Dy......Oy......Zy......oy......uy......}y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......y.......z.......z.......z......(z......4z......Az......Gz......\z......ez......lz......sz......yz.......z..%....z.......z.......z.......z.......z..K....z..0...#{..m...T{..#....{.......{..N....|..=....}..)...D}......n}......}}..0....}..4....}.......~.......~..........................0...........................).......5...'...G...*...o..."...............-..................................%.......<.......J.......d.......|...................................................../.......K.......g........................................................"..............................7...2...O...j...........K................../...)...6.......`.......|..........................................;......,...(.......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\si_LK\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1600 messages, Project-Id-Version: electrum ' (FX \340\266\234\340\267\217\340\267\203\340\267\212\340\266\255\340\267\224\340\267\200\340\266\232\340\267\212 \340\266\261\340\267\234\340\266\270\340\267\220\340\266\255)'
                                        Category:dropped
                                        Size (bytes):235682
                                        Entropy (8bit):5.151796827691006
                                        Encrypted:false
                                        SSDEEP:3072:Vj7fQ1yAWhpuafz+ZVw+slsgMIP1sFJsZuE+27qCa5011zil6eTkdvq4g5Tpf/QR:VjUYIMXWkWb501NeTkdvq4ITJ/mN
                                        MD5:356236F5E0E9E01F253A2382C66CC71F
                                        SHA1:04950205832F22B13FEABAB3CC5B37D14ACCE174
                                        SHA-256:32BB5B9493099384A9A834B1679D55D026A4E4B77426AAAA73266E07F619FC98
                                        SHA-512:5DDF9DD88E61B47C2D7F07375C533CC62D0CC576E88B0BA8679226FC2C8FEA8F7AFFB4D94FD6E9603089D947F30EADABE91615EBD5771188809EDC8A29B3E09D
                                        Malicious:false
                                        Preview:........@........2..Y....d..................................................................................................%.......+.......>.......L.......W.......b.......w.......}..................................................................................................................#......./.......<.......B.......W.......`.......g.......m.......u...................................K.......0......m..."...#...............=.......).....................0.......4...L...............$...............0...0...F.......w...........................'.......*..............-...........E.......M.......].......o.............................................................4.......P.......k........................................................R...........a..."...e...................7.......O..........7...K...E...................)..........................................)...'...8.......`...........;.......,......................................O... ...o...p...2.......!...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\sk_SK\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1345 messages, Project-Id-Version: electrum ' (Nie je k dispoz\303\255cii v\303\275menn\303\275 kurz)'
                                        Category:dropped
                                        Size (bytes):126100
                                        Entropy (8bit):5.4305341815611845
                                        Encrypted:false
                                        SSDEEP:3072:fkCqQlm3HkoVw+sls6hoXAp8rTE+HEnCkBUjpsmiDxR:fkCqvhwcYlBysmidR
                                        MD5:F0E5C0AD99A4347A28A811F389E4D8EE
                                        SHA1:502B1CBD0BDDE6E973C9027E61E67CA3EB4A635A
                                        SHA-256:23D462599B5A38AE46E5B7F563B6F8A960CA5E9D51A910B67EB0BEC064D9D747
                                        SHA-512:7D42B583D0913D23822CE787F6BDF06125166E4B96202B8B6BD6B41528EE42B00027A3BA6FF25502776A8A06ED87AB7B4F817E6ACA6FB92BD76EAB46FCB82538
                                        Malicious:false
                                        Preview:........A.......$*......,T......Pp......Qp......jp......xp.......p.......p.......p.......p.......p.......p.......p.......p.......p.......q.......q.......q......-q......3q......;q......Hq......Pq......bq......kq......xq.......q.......q.......q.......q.......q.......q.......q.......q.......q.......q.......q.......q.......r.......r.......r......$r......*r......2r......Cr......Ir......Pr......Wr..K...br..m....r..#....s..=...@s..)...~s.......s.......s..0....s.......t.......t......3u..0...Iu......zu.......u.......u.......u..'....u.......u..-....u.......v......%v......5v......Gv......^v......vv.......v.......v.......v.......v.......v.......w.......w......Jw......gw......qw.......w.......w.......w.......w.......w..7....w..O....x......Tx......bx......}x..)....x.......x.......x.......x.......x.......x.......y..;...+y..,...gy.......y.......y.......y..O....y..o....y..2...oz..!....z..K....z..1....{......B{......K{..9..._{..8....{.......{.......{.......{..(....|......*|..`...5|..b....|.......|......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\sl_SI\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 69 messages, Project-Id-Version: electrum 'Dokumentacija'
                                        Category:dropped
                                        Size (bytes):4110
                                        Entropy (8bit):5.091230435692075
                                        Encrypted:false
                                        SSDEEP:96:oXfbsjjfq8bjVuJsxsPoXM6RALYyxLkQo6Le:oXzsj7/bjoJsxsPUM6REYLQFLe
                                        MD5:318F32FC5C900BFD8EF107B055FEC754
                                        SHA1:EE88F2B9A8397C94F69A6FC6297F2EC83D304577
                                        SHA-256:3BD5B4434DADE5D352C209D0D55FACE09B9F8BC1BACCA913E213F8FD6219FF75
                                        SHA-512:28EED0376FC0C096BCFC83ED241D997E4B8D122BAA29EF499C5DD2FA63379C01E9523ACB190525108D56FAE51FD4570ED4D2B552BDF51D26132AEFDD7CEFB832
                                        Malicious:false
                                        Preview:........E.......D...a...l...............................................................'.......?.......W.......^.......f.......~.......................................................................................".......9.......T.......h..."...............................................................u...).......................................................................'.......B.......W.......m.......u......................................................./...!...M.......o.......t... ...y... ...........................................................0.......E...J...Q.......................................................................................................................................................&.......0.......B.......T.......n.......u.......z...............................................................................................................................................$.......9.......N.......U.......[.......b.......i.......t.......{.......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\sr_CS\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: electrum
                                        Category:dropped
                                        Size (bytes):677
                                        Entropy (8bit):5.415029617033475
                                        Encrypted:false
                                        SSDEEP:12:i4VxjCt0d+j/41r7WXmBQWivXmBQWii3bbkHzkj7f3ZPqAmZkTj8bpX:RHjCt0d+7s7WXmQXmHn+gjj9pmUjA5
                                        MD5:99E5C5C001D85FBD14B63A56D4CE3D33
                                        SHA1:C76519A51CA6D2A7DEEE5608D994414E0B976BAE
                                        SHA-256:2F868826E8E58EA9F8A2C4C1DAEAE90CF920C8A38BD9F3113B05A5AB7621BA18
                                        SHA-512:7706549A3DE886393C56E125EEEFF3BD138950FFEED840B6FADBDAE27ACB3567E52C210C45958C95B7136FACD922294DACE489901BF52AC35828DBB3AE4E9804
                                        Malicious:false
                                        Preview:................$.......,.......8...k...9................Project-Id-Version: electrum.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-05-29 13:38.Last-Translator: .Language-Team: Serbian (Latin).Language: sr_CS.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Qt-Contexts: true.Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);.X-Crowdin-Project: electrum.X-Crowdin-Project-ID: 20482.X-Crowdin-Language: sr-CS.X-Crowdin-File: /electrum-client/messages.pot.X-Crowdin-File-ID: 68..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\sv_SE\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 682 messages, Project-Id-Version: electrum ' (Ingen v\303\244xlingskurs tillg\303\244nglig)'
                                        Category:dropped
                                        Size (bytes):44478
                                        Entropy (8bit):5.1883421537661745
                                        Encrypted:false
                                        SSDEEP:768:em7kAF/xS3RQPgrxvFCQDNSsFyq3JmxB5MDIvUA/1UJqC:5YCS3QK9FxNSsFyq3JmKA/1UJt
                                        MD5:19D9389118B4862F2BC6BE565BD6CB17
                                        SHA1:3FA7CE711F35F47D12D760AAB9E5332E7601CBF0
                                        SHA-256:8B591DB3DF6D8D912C87276E2C4CCA0101354E6DC02F3E3BC95694C3AC26D935
                                        SHA-512:FB934799F36B78C214A0F089855DC24360BC8CE2CFA9C3DBF31A9C31CD937BAE7DBEDA96F4C598BA1E1812E73BB664E60CF12913A24ACE899A307B2FB8ECD6F0
                                        Malicious:false
                                        Preview:................l........*.......8.......8.......9...... 9......'9......29......A9......T9......[9......j9......|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:......$:......-:......::......L:......R:......\:......i:......o:......x:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......;.......;.......;.......;..#...$;..N...H;..=....;..)....;.......;.......<..0...-<......^<.......=.......=..0....=.......=.......=.......=..*....=......)>..-...9>......g>......o>.......>.......>.......>.......>.......>.......>.......?......!?......<?......X?......t?.......?.......?.......?.......?.......?.......?.......?.......?.......@.......@......-@......:@......L@......[@......z@.......@.......@.......@..O....@..o....@..!...gA..K....A..1....A.......B.......B..9...$B..8...^B.......B.......B.......B..(....B.......B.......B..2....C......<C......VC......bC......oC......|C.......C.......C.......C.......C......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\ta_IN\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 39 messages, Project-Id-Version: electrum '\340\256\207\340\256\265\340\257\215\340\256\265\340\256\277\340\256\237\340\256\244\340\257\215\340\256\244\340\256\277\340\256\262\340\257\215 \340\256\222\340\256\260\340\257\201 \340\256\252\340\256\260\340\256\277\340\256\265\340\256\260\340\257\215\340\256\244\340\257\215\340\256\244\340\256\251\340\257\210 \340\256\225\340\256\237\340\257\215\340\256\237\340\256\243\340\256\256\340\257\215 \340\256\252\340\256\260\340\256\277\340\256\250\340\257\215\340\256\244\340\257\201\340\256\260'
                                        Category:dropped
                                        Size (bytes):3933
                                        Entropy (8bit):5.26212156261863
                                        Encrypted:false
                                        SSDEEP:96:YiNReugw5WCs7LYbxdE4iD/15i6TNtiDte9cadVlv:YiXPTWCsHY/4D11NcjWlv
                                        MD5:D19E6DFBBBFD4D6415780A44F821824B
                                        SHA1:F32B3CFDC75EB6924C2ED59A2D2EC4397149482B
                                        SHA-256:EAD72F879C18C7970EFC80DD1EB7DB0ABC1ED20EF1DD3E849EF328330E400C36
                                        SHA-512:497A99287A38549921CACC1C4C91B2F7D2308AA56EE6646C074FEDED12CE4ABBFEA8027119208EBF2245FA548F1995DC96A70E24143386A8F363919F8E8172CA
                                        Malicious:false
                                        Preview:........'.......T...5...........`.......a...............................".......9.......@.......H...c...`.........................................................................../...........K.......S.......e.......|..........................."...................!.......6.......S.......j................... ..............................................................."...........&.......9..."...F..."...i...%...............................................J...........S.......`.......s...............................;.......N.......g.......z.......................................................................................0.......@.......M...............................................................................................................$.......................%... ..."...........&...............#...............!...'........................A suggested fee is automatically added to this field. You may override it. The suggested fee increases with the size of the transaction

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\th_TH\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 386 messages, Project-Id-Version: electrum ' (No FX rate available)'
                                        Category:dropped
                                        Size (bytes):42055
                                        Entropy (8bit):5.271881615004976
                                        Encrypted:false
                                        SSDEEP:768:LtFmbbWX/Xyw+slsDWX1sXnJRI9V8LZvWVz6p+1nga9VpMZycwRfmuegYHCm3lqN:LrYWX/iw+slsDWSXLz+WdEkuBDA/yHpD
                                        MD5:B3AEE2FB6C4947D00E300D4FB5E3C2F6
                                        SHA1:EBB68C565E973F46891A49686D7D7BFFB3BF7B2D
                                        SHA-256:485D1C7BD377FD61E4E15492050ACCBE648221F5CE2C8867DFC67AB37A2F984F
                                        SHA-512:3359D170BA06B9671EDA50A04C5994665F9E4E97EBD3D0BA6DD8C60AB37588EB8B79E3C71CF811072EA3CFE7809BE6558BCB363F7DB3A4A2004023C4544F88EC
                                        Malicious:false
                                        Preview:................,.......<.......` ......a ......z ....... ....... ....... ....... ....... ....... ....... ....... ....... .......!.......!.......!......,!......7!......B!......W!......]!......e!......r!......z!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!......."......."......."......""......7"......@"......G"......N"......T"......\"......m"......s"......z"......."..K...."..0...."..m....#..#...w#.......#..=...l$..)....$.......$.......$..0....%..4...3%......h%.......&.......&.......'......-'......9'..'...K'..*...s'.......'..-....'.......'.......'.......'.......(.......(......7(......O(......g(......~(.......(.......(.......(..R....(.......).."....)......<)..7...O)..O....).......).......).......*..)....*......1*......M*......^*......k*......}*.......*..;....*..,....*.......+......%+......++..O...2+..o....+..2....+..!...%,..K...G,..1....,.......,.......,..9....,..8....-......U-......a-......v-..(....-.......-.......-..`....-..b...(...2...........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\tr_TR\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1069 messages, Project-Id-Version: electrum ' (D\303\266viz kuru yok)'
                                        Category:dropped
                                        Size (bytes):75365
                                        Entropy (8bit):5.352463961007435
                                        Encrypted:false
                                        SSDEEP:1536:hBxRfNdrbhukCdUhFFdumvcXE+7i94ttHDWBgb7:vXfnnWiFOE+7V9DWU7
                                        MD5:73E73DED000AA69FA5A6A7A297A9AA52
                                        SHA1:3D1E2F510EEE3493F4535509F56D4683166E0587
                                        SHA-256:33CDDD896DF7CFADD0B0B3ABE47D08AB0A8F0F5DCC46985C926C813C5DDE2ED1
                                        SHA-512:3C1CB6C6DB0760738C8DE57DE34925F8A72AD76FCC054CBE98698D5F9885655F988015A2A63319EE29C29355D88B7BEA965F7B1EF4CAFE9D55A206197058024B
                                        Malicious:false
                                        Preview:........-........!.......B......8Y......9Y......RY......`Y......gY......rY.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Y.......Z.......Z.......Z....../Z......5Z......=Z......JZ......RZ......dZ......mZ......zZ.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......Z.......[.......[......#[......,[......3[......:[......@[......H[......Y[......_[......f[......m[..K...x[..m....[..#...2\......V\..N...']..=...v]..)....].......].......]..0....^..4...=^......r^......._......._..0...._......._......._.......`.......`.......`..'...1`......Y`......h`......|`..-....`.......`.......`.......`.......`.......`.......a..M...'a......ua.......a.......a.......a.......a.......a.......b......(b......Db......`b......}b.......b.......b.......b.......b.......b.......b.......b.......c.......c.......c..7...(c..O...`c.......c.......c.......c..)....c.......d......&d......7d......Dd......Vd......ed.......d..;....d..,....d.......d.......e.......e......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\uk_UA\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 1324 messages, Project-Id-Version: electrum ' (\320\235\320\265\320\264\320\276\321\201\321\202\321\203\320\277\320\275\320\260 \321\226\320\275\321\204\320\276\321\200\320\274\320\260\321\206\321\226\321\217 \320\277\321\200\320\276 \320\272\321\203\321\200\321\201 \320\276\320\261\320\274\321\226\320\275\321\203)'
                                        Category:dropped
                                        Size (bytes):156483
                                        Entropy (8bit):5.480518723378095
                                        Encrypted:false
                                        SSDEEP:3072:T5b0SqAIVw+slspZolkYJeE+g8uCFnBGU6VPvsh0IhDqf+0c:3H+QZ2xX8f8
                                        MD5:6D49E672FA1F9EF6AEB36FE9184FB696
                                        SHA1:5765C3B04D33D1BFEE469C7A74E0356D09AEA6F6
                                        SHA-256:56FDAA05055D1A5311141BBDF9B1D768602FB0CB0BD9AE388FB199E29EBBCEDD
                                        SHA-512:7E37C4CBEF8CCB3B4EF5F327826A8F3FB58A70444F9BFB85C28112593241BF7DB4337AD799E070D2D9DFFED9B570C566E94C659F5F402CB87CD6E794A21E6035
                                        Malicious:false
                                        Preview:........,.......|).......R.......n.......n.......n.......n.......n.......n.......n.......n.......o.......o......$o......=o......Eo......Ko......Yo......do......oo.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......p.......p.......p......!p......0p......<p......Ip......Op......dp......mp......tp......{p.......p.......p.......p.......p.......p.......p..K....p..m....q..#...sq..=....q..)....q.......q.......r..0...-r..4...^r.......r......6s.......s......Bt..0...Xt.......t.......t.......t.......t..'....t..*....t.......u..-...)u......Wu......_u......ou.......u.......u.......u.......u.......u.......u.......v......+v......Fv......bv......~v.......v.......v.......v.......v.......v..R....v......<w......@w..7...Sw..O....w.......w.......w.......x..)....x......5x......Qx......bx......ox.......x.......x..;....x..,....x.......y......)y......4y......:y..O...Ay..o....y..2....z..!...4z..K...Vz..1....z.......z.......z..8....z......*{......6{......K{..(...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\vi_VN\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 212 messages, Project-Id-Version: electrum ' (Kh\303\264ng c\303\263 \304\221\303\241nh gi\303\241 FX s\341\272\265n c\303\263)'
                                        Category:dropped
                                        Size (bytes):14470
                                        Entropy (8bit):5.453162760413832
                                        Encrypted:false
                                        SSDEEP:192:fz2DrLU4mGUbpbNWD8UVdOPXr+vAJDQCDDbjohsxsvhJ4g6RfYUUU6RAb6oMVenT:6k4yNbsD8UVdX8TJmvU3UU3iVg+wyQ
                                        MD5:44262E945465E2FF48001D5A73B11206
                                        SHA1:1BB40E65B6F2C1901802D71DFD805CC29C049BDB
                                        SHA-256:EDB58370DD8A4F8B6246D17FC36623ADC9992ECBCD1D02F34A07682C1970F623
                                        SHA-512:D0B0A06BCE7C4117B803378C45FDE078B41A50CFA5605BB163039527EEB6B2D5451E045BCA3B3CBF8E302F53BDE731C75B3C68F0ECC0BC343670FA0953FB74BB
                                        Malicious:false
                                        Preview:........................\...............................................................$.......+.......:.......L.......e.......m.......s...............................................................................................................".......,.......9.......?.......H.......V.......\.......k.......w...................................................................................)...........................................................................................).......4.......9.......A.......Y.......c.......}...........c...)...............................................................................................0...F..._...O...........................................................&.......:.......L.......Y.......n.......w.......|.........................................................................../...........5.......=.......J..."...j...................j..........."...f...7...........G.......1.......-...(...4...V...4...................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\zh_CN\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 2447 messages, Project-Id-Version: electrum ' (\346\227\240\345\217\257\347\224\250\346\261\207\347\216\207)'
                                        Category:dropped
                                        Size (bytes):225849
                                        Entropy (8bit):6.2687401634019295
                                        Encrypted:false
                                        SSDEEP:3072:Pq0PJWCkLkR6tGcHVw+slsuTiMwsvFylTK7gMV2YE+/2lULUC+kA+Q+Ldb09cFVz:PqEJWVS6sOswI2dFkZ0Sk8R
                                        MD5:D39ACB07795ACA6D83CC799FD7DAA863
                                        SHA1:515D187EC46EEFE3201FEF5F8263C3B9539BA8CF
                                        SHA-256:5370DB5CB0CB9B757CCF70B149C227C70368AFA56335FCEADA28669F2DAAF43A
                                        SHA-512:0CCFE9554A96BF9BBE433428778772C093243C7E294A3913CC3D68ABB54EF501B0EF8E4522271CBAA62EE37D9852239D98169F7B1811C2DB5048B6E39D8688D9
                                        Malicious:false
                                        Preview:.................L..............(.......).......B.......P.......W.......b.......q.......................................................................................................%.......-.......:.......B.......T.......].......j.......w.......~.......................................................................................................................#.......*.......0.......8.......I.......W... ...g...........$.......%...............'........... .......&.......-...;...4.......p...K...{...0.......m.......#...f...........N...[...=.......)...................!...0...@...4...q...............I...........L...U...>.......................0...........:.......J.......Y.......l...................................................'.......,.......'...<...&...d...+.......*.......................3.......1...9..."...k...........-...................................................'.......5.......O.......k...................M...........................4.......T.......s.......................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\locale\zh_TW\LC_MESSAGES\electrum.mo

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:GNU message catalog (little endian), revision 0.0, 594 messages, Project-Id-Version: electrum ' (\345\214\257\347\216\207\350\263\207\350\250\212\344\270\215\345\217\257\347\224\250)'
                                        Category:dropped
                                        Size (bytes):44423
                                        Entropy (8bit):5.975443020349473
                                        Encrypted:false
                                        SSDEEP:768:WmVjCLKlanTuejb+/nKt4PKmabE+rwxgZUWNk17w/wgDdg1TTopWWOLf5cAQai9:Wij0KcnTDbOnKt4PKm+E+r0ckC4Dog94
                                        MD5:01CD1BDAB79C7ADE9836812A2B963C4D
                                        SHA1:FB94BCC16AA883CF402DA1DEB6BFA2F7A0313F2F
                                        SHA-256:9DAF20DCE1BF729AED92B46B515269BD50A4C4AEDC4942414E167EFBE247A786
                                        SHA-512:F594545356DEB2412E44058CBE7EB3018986F664651662BA1CAE11F434B8BD33263AF75EBB0F183DD97EE9C9B105E8FBAF7B3A68EC1503E4A72B8700B5D6AEFE
                                        Malicious:false
                                        Preview:........R...............<%.......1.......1.......1.......1.......1.......1.......1.......2.......2......"2......42......M2......U2......[2......n2......|2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......3.......3.......3......!3......'3......03......>3......D3......S3......_3......l3......r3.......3.......3.......3.......3.......3.......3.......3.......3.......3.......3..K....3..0...(4......Y4..N...*5..=...y5..)....5.......5.......5..0....6..4...@6......u6.......7.......7......$8......:8......I8......U8..'...g8..*....8.......8..-....8.......8.......9.......9......"9......99......S9......k9.......9.......9.......9.......9.......9.......:.......:......):..R...2:.......:.."....:.......:.......:..7....:..O....;......[;..K...i;.......;.......;..)....;.......<.......<.......<......;<......M<..'...\<.......<.......<..,....<.......<.......<.......<.......=..O....=..o...X=..2....=..!....=..K....>..1...i>.......>.......>..9....>.......>.......>.......?......

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\README

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1525
                                        Entropy (8bit):4.308909802534244
                                        Encrypted:false
                                        SSDEEP:24:Rg1PepJW3MdGwZVc/qVRHv9Fv8Rx8tPhAjOTNkNITuGTkAz+pzoAxq4iZv9q3A:q12pJYSGnSVRHTv8R8yjOpBTkAovRiZz
                                        MD5:C818A526EC8E002419BB86F9B791AE21
                                        SHA1:6633DCF0BDAF6DA74BEE0DA01FC67D36A130DF69
                                        SHA-256:A4A22B8BF021FEB1096C611F4F5A9EDA63D6C189A5609C1460718EBF87FABB17
                                        SHA-512:541EA923A28BE16A6940E0306D62DE71BC4D25DD1E85E17B80DFF5568F3BA63EFDAD5B6EF259E797E300B7DF0644DC796F8754259AB95625F43BDE672673B2C4
                                        Malicious:false
                                        Preview:Plugin rules:.. * The plugin system of Electrum is designed to allow the development. of new features without increasing the core code of Electrum... * Electrum is written in pure python. if you want to add a feature. that requires non-python libraries, then it must be submitted as a. plugin. If the feature you want to add requires communication with. a remote server (not an Electrum server), then it should be a. plugin as well. If the feature you want to add introduces new. dependencies in the code, then it should probably be a plugin... * We expect plugin developers to maintain their plugin code. However,. once a plugin is merged in Electrum, we will have to maintain it. too, because changes in the Electrum code often require updates in. the plugin code. Therefore, plugins have to be easy to maintain. If. we believe that a plugin will create too much maintenance work in. the future, it will be rejected... * Plugins should be compatible with Electrum's convention

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1164
                                        Entropy (8bit):5.131212790283945
                                        Encrypted:false
                                        SSDEEP:24:UIxok4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFs:UMotJdVlPvLTmawQHlsyHIO5d3D1Fs
                                        MD5:4F2F1D52356EF8175E80B790A2CC8004
                                        SHA1:F30F2EE67771A1B57AEA74319F6CBD49B55BDB11
                                        SHA-256:D05BF2C5E001E8642AC43A0399F4681C48E94A1FEB2D37EE073E243D7547735E
                                        SHA-512:7329029BF99337D0A1B353BF155F66E09B1200263E4F4CCA898CBD1E145F53A5573AF85FF0453DF54B196544F888FD3C6C0CD5DCE35599D5ABCD3826939B1569
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\audio_modem\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):214
                                        Entropy (8bit):4.927871904173466
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhF17v6IFP8EGYGP1/JFuAyEKLfKhbfOVrI7:1YvQJF176eVTQ/pyEKKAV07
                                        MD5:6790EF548CB2261AD89A53C5C3D0CFF4
                                        SHA1:422AB91148D7A45B9F95E2A866C42A112DD3AE85
                                        SHA-256:0A038364785B2A50A43A3EBB2ADB079E1DA54D81F050FC815A6B4025D723650E
                                        SHA-512:0D8CDAA2A8B6EB90184E84817A7E6C13277580AD98B2B8E555167EB4CD935FE5B6DAA800170723C1A34E3C8BF5E8D9DE0062B64B2A97F7E99B564F808EE255DF
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('Audio MODEM').description = _('Provides support for air-gapped transaction signing.').requires = [('amodem', 'http://github.com/romanz/amodem/')].available_for = ['qt']..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\audio_modem\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):4293
                                        Entropy (8bit):4.671629688157907
                                        Encrypted:false
                                        SSDEEP:96:k6IjmUaWG4flas0JqWRfR5y9VzJqC/Mz4T4M:kBIly97AC4M
                                        MD5:F1069BB5F0A50A1BCE038DF8944355A8
                                        SHA1:AB214EAF4EEF7FBDF9A26824026183AF5B13964D
                                        SHA-256:37C15EE2AC33135163692FA35F63F2297D77BA3DFDF8E0AF6547CBB70C45CBF1
                                        SHA-512:2B93A3E9D4F7D3528D7A515D6EF5846F1F31AAC3F4B7CD3EAB13BD7CBFB1A5E6D427F0B954C311B45E82B7B49846D59A4577FAC81AF25BD15B3412C4C89CD191
                                        Malicious:false
                                        Preview:from functools import partial.import zlib.import json.from io import BytesIO.import sys.import platform.from typing import TYPE_CHECKING..from PyQt5.QtWidgets import (QComboBox, QGridLayout, QLabel, QPushButton)..from electrum.plugin import BasePlugin, hook.from electrum.gui.qt.util import WaitingDialog, EnterButton, WindowModalDialog, read_QIcon.from electrum.i18n import _.from electrum.logging import get_logger..if TYPE_CHECKING:. from electrum.gui.qt.transaction_dialog import TxDialog..._logger = get_logger(__name__)...try:. import amodem.audio. import amodem.main. import amodem.config. _logger.info('Audio MODEM is available.'). amodem.log.addHandler(amodem.logging.StreamHandler(sys.stderr)). amodem.log.setLevel(amodem.logging.INFO).except ImportError:. amodem = None. _logger.info('Audio MODEM is not found.')...class Plugin(BasePlugin):.. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, config, name). if self.is

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\bitbox02\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):4.81573664495697
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhHpXeeawJ6IFlX2UEiVMr8/KI+eQhCag03KNQohQiIXdQGVbRC:1YvQJJXeRwJ6AXxVVWST+p0aNAJIX2Gi
                                        MD5:A4F7A31824929EEEB0B69FE5AE80F9BE
                                        SHA1:3114463FA7C37DC91487FE3DEDFA5C13E33A9DF8
                                        SHA-256:868C0438C6AC79EB4A5AE1CF57A0649EB20C9DD936256A553A5269E2826AE08B
                                        SHA-512:2D703F9C0BBD34319739531ED482DEB3C143026A18A8FFF76A942BF24D832C5E02266935BD77E7594DA72D218F1E90C727C9B10DCC6B16445F6265C1072A7196
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = "BitBox02".description = (. "Provides support for the BitBox02 hardware wallet".).requires = [. (. "bitbox02",. "https://github.com/digitalbitbox/bitbox02-firmware/tree/master/py/bitbox02",. ).].registers_keystore = ("hardware", "bitbox02", _("BitBox02")).available_for = ["qt"].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\bitbox02\bitbox02.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):28018
                                        Entropy (8bit):4.48147860211988
                                        Encrypted:false
                                        SSDEEP:384:5Maamch5a5d9w8QwUUvK4pDP/p7KXPS7Ig:5Vw8QuvK4pDP/4Xg
                                        MD5:F04F6DA3B6341CA22848C3F7851150A6
                                        SHA1:A4BD9AA3D6933AFA602A9C6FDC32626C78D504CE
                                        SHA-256:026B76DFAE55C369527F3C8B508D8354EB6D4A3D82B8BD5C89ED1180B14F5BB1
                                        SHA-512:FE367C78857EAE07A2B89F732A70D6312C066B5AC1ED54AAD32DD866D58A5094C08AD5D8D604FA2CDBBA621AD70084647E7F058C733C67408ED891158F20AB60
                                        Malicious:false
                                        Preview:#.# BitBox02 Electrum plugin code..#..import hid.from typing import TYPE_CHECKING, Dict, Tuple, Optional, List, Any, Callable..from electrum import bip32, constants.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.transaction import PartialTransaction, Sighash.from electrum.wallet import Multisig_Wallet, Deterministic_Wallet.from electrum.util import UserFacingException.from electrum.logging import get_logger.from electrum.plugin import Device, DeviceInfo, runs_in_hwd_thread.from electrum.simple_config import SimpleConfig.from electrum.storage import get_derivation_used_for_hw_device_encryption.from electrum.bitcoin import OnchainOutputType..import electrum.bitcoin as bitcoin.import electrum.ecc as ecc..from ..hw_wallet import HW_PluginBase, HardwareClientBase, HardwareHandlerBase..if TYPE_CHECKING:. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. from bitbox02 import bitbox02. from bitbox02 import ut

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\bitbox02\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):5643
                                        Entropy (8bit):4.7627608623319
                                        Encrypted:false
                                        SSDEEP:96:jQmy0hAHGWr0R30XV1SfInwJy9vDlptPHmsqJCHsUqTTSh:kaGmvOL8o9lrqzSh
                                        MD5:E03CB4AEDED7CEF59F49FEBE14025E2A
                                        SHA1:2D795898789DE87CE04643664A9D23FDDFC07001
                                        SHA-256:944725841380108F2FDFFD8A76920108D95D9BC45AB3C5C1EFC2BD16734A4E7A
                                        SHA-512:CD9F67AF1F488DFAD5F4FFFD138CB80676C8D963BB2102460CED826724284E8E970E0332218119952FF7880B7CC477F326F372486E3D2411F70BE8D8A2F8F0E0
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QMetaObject, Q_RETURN_ARG, pyqtSlot, pyqtSignal.from PyQt5.QtWidgets import QLabel, QVBoxLayout, QLineEdit, QHBoxLayout..from electrum.i18n import _.from electrum.plugin import hook.from electrum.util import UserCancelled, UserFacingException..from .bitbox02 import BitBox02Plugin.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available, OperationCancelled..from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUnlock, WCHWUninitialized, WCHWXPub.from electrum.gui.qt.util import WindowModalDialog, OkButton, ButtonsTextEdit..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(BitBox02Plugin, QtPluginBase):. icon_unpaired = "bitbox02_unpaired.png". icon_paired = "bitbox02.png".. def create_handler(self, window):. return BitBox02_Handler(window)..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\coldcard\README.md

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1599
                                        Entropy (8bit):4.733667781245139
                                        Encrypted:false
                                        SSDEEP:48:3w/sAYSjlkL2p9tJW0AL7gdNlnymtgaAW2VXOYM:3w/CSjU2p9tQ0BNlnyXM2NBM
                                        MD5:E23ECE2F407341B9321074891D211AA0
                                        SHA1:DAAC9FD399D8DD6BDA56092331BE11B0D302F2C1
                                        SHA-256:1988F0E2EE3452D900B75440A500F2CC0AEA7F4FCE4DFEB19353FF46651ECC67
                                        SHA-512:1F582B451A8FA9B47F38FD3CE4843E1E6164E0FBB05FEC9EA218865BB0D8A6680B199B7CFEA74E0E1E1BF5FFAFAC2A3C4ECCCB0E07C6EA099F658FACBBD46817
                                        Malicious:false
                                        Preview:# Coldcard Hardware Wallet Plugin..## Just the glue please..This code connects the public USB API and Electrum. Leverages all.the good work that's been done by the Electrum team to support.hardware wallets...## Background..The Coldcard has a larger screen (128x64) and a number pad. For.this reason, all PIN code entry is done directly on the device..Coldcard does not appear on the USB bus until unlocked with appropriate.PIN. Initial setup, and seed generation must be done offline...Coldcard uses the standard for unsigned tranasctions:..PSBT = Partially Signed Bitcoin Transaction = BIP174..The Coldcard can be used 100% offline: it can generate a skeleton.Electrum wallet and save it to MicroSD card. Transport that file.to Electrum and it will fetch history, blockchain details and then.operate in "unpaired" mode...Spending transactions can be saved to MicroSD using by exporting them.from transaction preview dialog (when this plugin is.owner of the wallet). That PSBT is then signed on the C

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\coldcard\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):308
                                        Entropy (8bit):4.780432453957694
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhcBTRXrml6IFX0myCDKJSpEG+dwS0wKNQo6KcPleQXBGVrIeCM7in:1YvQJwg6xmyCDKgarBt2x2GV0dM+n
                                        MD5:EA4F01C6131621AE973CEB62B3DBC196
                                        SHA1:F1A6745F5CA08BBB972C08D3CFB374CA6B65AC98
                                        SHA-256:A25ABE5EE2830E4EE8C47D45A6FC5D4A202E0ADB08FCF6C2026108FAF3518D8F
                                        SHA-512:AD11CD1FC57EC3D2A6B0D7DFF5C71F420967502EFF971CEC9E2651AE3463645B30B0E6300053684491367837A548A79FF4C9E56C97CF673E09491F50DB7726C6
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Coldcard Wallet'.description = 'Provides support for the Coldcard hardware wallet from Coinkite'.requires = [('ckcc-protocol', 'github.com/Coldcard/ckcc-protocol')].registers_keystore = ('hardware', 'coldcard', _("Coldcard Wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\coldcard\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1090
                                        Entropy (8bit):4.573310061544046
                                        Encrypted:false
                                        SSDEEP:24:1/d1AZBPxya0mPxrnD8PxS1XXmrxxuPwHvsb/aC9sahfA0yGl:dvAVb0Krn4AixIsvwaCVZ5
                                        MD5:8870C7B7E30C1CD7FD068D93A5E3B6DE
                                        SHA1:EED10756BCF0F33C70F13FAD219462F53DB9FA5D
                                        SHA-256:CD39D765EBB9C0F55B3D7C81C7300B824342E24B3D361AD6A62838665FA99447
                                        SHA-512:82922FEF123FB09E3C334E1C8597D3737498C50B155758144BFAD328CB47734FF7E0CFE7919911136D058709A86BEAE16D88386F2C1BE9C862834550C7FE5DA0
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from electrum.util import print_msg, raw_input, print_stderr.from electrum.logging import get_logger..from ..hw_wallet.cmdline import CmdLineHandler..from .coldcard import ColdcardPlugin..._logger = get_logger(__name__)...class ColdcardCmdLineHandler(CmdLineHandler):.. def get_passphrase(self, msg, confirm):. raise NotImplementedError.. def get_pin(self, msg, *, show_strength=True):. raise NotImplementedError.. def prompt_auth(self, msg):. raise NotImplementedError.. def yes_no_question(self, msg):. print_msg(msg). return raw_input() in 'yY'.. def stop(self):. pass.. def update_status(self, b):. _logger.info(f'hw device status {b}').. def finished(self):. pass..class Plugin(ColdcardPlugin):. handler = ColdcardCmdLineHandler().. @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\coldcard\coldcard.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):24659
                                        Entropy (8bit):4.600096072868321
                                        Encrypted:false
                                        SSDEEP:384:ET7cFOAFQcAsm0nxFG3iEOtkVtZOTJc8vIVp5DUsAtN:60ulfZrL5DUPv
                                        MD5:AE37F81847578906E1BB368CB99C6E5E
                                        SHA1:3CE722E0F590E777ACC40148D20D9B87638A74FF
                                        SHA-256:E7273E605B53806F92EB490198218841B4BCE3C716EDDB87B48DDB294B4C48C6
                                        SHA-512:4EE95AD84F93FD8A0268D89410571C866EFEB65CFC4E3DEA9AEF9B927E1D59B2D3F89AFBFEF873ED0C206D89EDE4266C66BDC9406F5833832952DCBF44CA992E
                                        Malicious:false
                                        Preview:#.# Coldcard Electrum plugin main code..#.#.import os.import time.from typing import TYPE_CHECKING, Optional.import struct..from electrum import bip32.from electrum.bip32 import BIP32Node, InvalidMasterKeyVersionBytes.from electrum.i18n import _.from electrum.plugin import Device, hook, runs_in_hwd_thread.from electrum.keystore import Hardware_KeyStore, KeyStoreWithMPK.from electrum.transaction import PartialTransaction.from electrum.wallet import Standard_Wallet, Multisig_Wallet, Abstract_Wallet.from electrum.util import bfh, versiontuple, UserFacingException.from electrum.logging import get_logger..from ..hw_wallet import HW_PluginBase, HardwareClientBase.from ..hw_wallet.plugin import LibraryFoundButUnusable, only_hook_if_libraries_available..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. import hid. from ckcc.protocol import CCProtocolPacker, CCProtocolUnpacker. from ckcc.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\coldcard\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):9720
                                        Entropy (8bit):4.7607121749672
                                        Encrypted:false
                                        SSDEEP:192:CCEIRwrvz1dIK2P6ua6NG9UFOi2j1HMjK94:TEI64Sx9UFOi2j1HP4
                                        MD5:39CA9012A128A6A73D6FB1D6A806BC3E
                                        SHA1:3B58E78EB9F910A41E5A64244E4D86214CD53268
                                        SHA-256:EF2C9F1027D540A42683E57AE249D6835ED7DDB69762C3C8460B4A7400C265D3
                                        SHA-512:91D1954B41FA490DA3C390956A14C4423879CD1E3A54FA48DDB873C6CA2D8374626A7221A0270257E5AEBFB79EA326DA251581AFBDA9AE5B070EF5A9503C7511
                                        Malicious:false
                                        Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt.from PyQt5.QtWidgets import QPushButton, QLabel, QVBoxLayout, QWidget, QGridLayout..from electrum.gui.qt.util import WindowModalDialog, CloseButton, getOpenFileName, getSaveFileName.from electrum.gui.qt.main_window import ElectrumWindow..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Multisig_Wallet..from .coldcard import ColdcardPlugin, xfp2str.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWXPub, WCHWUninitialized, WCHWUnlock..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard..CC_DEBUG = False...class Plugin(ColdcardPlugin, QtPluginBase):. icon_unpaired = "coldcard_unpaired.png". icon_paired = "coldcard.png".. def create_handler(self, window):. return Coldcard_Handler

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\cosigner_pool\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):4.759186715601759
                                        Encrypted:false
                                        SSDEEP:6:1YvQdLhFiE7bqMrI+7FVYlARbJvNAk1ThEGe5BMysT/ALeHAfmG/QBwxC3P532Ld:1YvQJh6Mrj7FVRvRTS/ngNgeGc6YGli0
                                        MD5:E2BB461D422E50929D6997B2DBE21A2F
                                        SHA1:5E177F624FAB2BA8937CDE5CC79E83FBDA438840
                                        SHA-256:BB99B42569DC28A3A8D6EB372575952B5AD08B9B384F6BB16A10CE60015D4EC8
                                        SHA-512:C4CE543D86B449816003A79D0210356020EBD0035B69721C8CB5571B18D44D14C2DBA2D4356691EB361C3B4852B50CFBBE39A518370FA612A66FE3B2B5829674
                                        Malicious:false
                                        Preview:from electrum.i18n import _.fullname = _('Cosigner Pool').description = ' '.join([. _("This plugin facilitates the use of multi-signatures wallets."),. _("It sends and receives partially signed transactions from/to your cosigner wallet."),. _("Transactions are encrypted and stored on a remote server.").]).#requires_wallet_type = ['2of2', '2of3'].available_for = ['qt'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\cosigner_pool\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):11676
                                        Entropy (8bit):4.662484746362187
                                        Encrypted:false
                                        SSDEEP:96:rzPjdwQHzJD3qvLm0tY9SOUuW3hEnp1ak/WG4/tjBec8kRvcsnAvGta6OPSiMKCO:rdwQHduvLm9rUr3hY11et8PIXQWcSc
                                        MD5:34E953135C8DC4322C18F89B4EEBFAAC
                                        SHA1:022B9442792DF41089999CE15620BC71F736E991
                                        SHA-256:BCD052A9DD43F50DA83B3F2597B3E7F8BAC12DA590F50E594CAEBE037599C726
                                        SHA-512:4393985BDAB65A5B12B564D071AD6EC2D008CB319083D9929F16FE07315846AA6A05C398038A95E2DA84812EACDC7A52A9754DF71CEC6711DFBFC5855DF42F07
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2014 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\digitalbitbox\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):241
                                        Entropy (8bit):4.784377531884513
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhiMpgrBkv6IFQWFngKNQo6K1AayX+WGVrIeCM7in:1YvQJiEgFa6pWFg21AXHGV0dM+n
                                        MD5:444DDD276080B4DE4EFACE108A2DAAF9
                                        SHA1:0A0BBC93200366A16B9E215F9A9FA587113B5B4D
                                        SHA-256:96C60D1D9FEDE5EF8010000FC6241BEAC23112C120A52953B52BE3428147F5D7
                                        SHA-512:8646AF3BC3A6916881C82CD5AA1BF6E986E652E633060A485200CE29DF1E32A48D0DE9A9561708606A28B7341535AADCE347A1BEDC9597C751E5BE062A806807
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Digital Bitbox'.description = _('Provides support for Digital Bitbox hardware wallet').registers_keystore = ('hardware', 'digitalbitbox', _("Digital Bitbox wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\digitalbitbox\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):419
                                        Entropy (8bit):4.548925765726323
                                        Encrypted:false
                                        SSDEEP:12:1KM82l8nDMz+85QDMm2Hvsb/aCTATSvehahBNA099a/:1/+fj6Hvsb/aC9sahfA0y/
                                        MD5:8631469CD0F206ADAB39997AA499CA9C
                                        SHA1:BC5FF5912135E8E31473B8FAD264E5ABFF199A15
                                        SHA-256:4CB7671A72CDE8A9F782897998568E89547C41D3C3AE41C5CC4306AB43E75B20
                                        SHA-512:A3E0D3BD49DD7E6BCB9E7D432B0D63EF82187A8FA2D9D1543E40683F06473C3D1BD0849E68B68497E32102661A1A5285C186E13ACEDC3904EB217C8715215A43
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .digitalbitbox import DigitalBitboxPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(DigitalBitboxPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\digitalbitbox\digitalbitbox.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):32787
                                        Entropy (8bit):4.5602859394966755
                                        Encrypted:false
                                        SSDEEP:192:CuqD+/3dlB3r92cNM+QbBR5pF1ohL0ET/8/snK/+JFVWn9OxhEaDmXLiJzcaVCRl:CfwDFr3IpUOsnKeFwnbL36bt7sfafM
                                        MD5:B7051A3F11741AB137504C97C06BDEE6
                                        SHA1:09EB8F9F873DA6AFFE4897F968D6BC8C3C4547CE
                                        SHA-256:675F51AC01C4E4A5FA0FC63346DFC3E9ECCB74832C5B4554B5A93541D9B9DC60
                                        SHA-512:4BB3656BDF45F64305A87148268F867AB8163DC4D0FB804784DBC58F36F4C714E86307F364C5BDC23C2BAEE020EC2B67D5785EBFC5F2E160B6951D9145F98857
                                        Malicious:false
                                        Preview:# ----------------------------------------------------------------------------------.# Electrum plugin for the Digital Bitbox hardware wallet by Shift Devices AG.# digitalbitbox.com.#..import base64.import binascii.import hashlib.import hmac.import json.import math.import os.import re.import struct.import sys.import time.import copy.from typing import TYPE_CHECKING, Optional..from electrum.crypto import sha256d, EncodeAES_bytes, DecodeAES_bytes, hmac_oneshot.from electrum.bitcoin import public_key_to_p2pkh.from electrum.bip32 import BIP32Node, convert_bip32_intpath_to_strpath, is_all_public_derivation.from electrum.bip32 import normalize_bip32_derivation.from electrum import descriptor.from electrum import ecc.from electrum.ecc import msg_magic.from electrum.wallet import Standard_Wallet.from electrum import constants.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\digitalbitbox\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3917
                                        Entropy (8bit):4.690719249837408
                                        Encrypted:false
                                        SSDEEP:48:j3rmoVL0OH4FFmOxJMCzJ0OOb8rNo+th5yfKOvdRBTOkttRtT58YyCawfjHwd80k:jbmU0dMCV0aR77yVV1ttzTvaqTZXSZq
                                        MD5:A6DDE05E304B8218F0016BBA47BA0DB2
                                        SHA1:C05FFF43F9E8C5E803FB3A7CA552A3B945EA8E94
                                        SHA-256:34E29A7E9D26DA850F634BF97F82C74A925C31369ADF1C55AFE4390F25443E4F
                                        SHA-512:8114478507BFC4CD3E4D47B8F485F84EDD660E8BE94F3BC3C98578718CAEDF8386C1451EA7DDF826A05FB69CD0CCC721FB0F3E83D6087BB3F268C8438FBAB0AD
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet, Abstract_Wallet.from electrum.util import UserCancelled, UserFacingException..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet.plugin import only_hook_if_libraries_available, OperationCancelled..from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWXPub, WCHWUnlock..from .digitalbitbox import DigitalBitboxPlugin, DeviceErased..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(DigitalBitboxPlugin, QtPluginBase):. icon_unpaired = "digitalbitbox_unpaired.png". icon_paired = "digitalbitbox.png".. def create_handler(self, window):. return DigitalBitbox_Handler(window).. @only_hook_if_libraries_available. @hook. def receive_menu(self,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\hw_wallet\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):111
                                        Entropy (8bit):4.457214322966268
                                        Encrypted:false
                                        SSDEEP:3:1LVepMIgBi6MC8EwnN/sunV1HZGYM0FbQ5k0tiBin:1LVMMIiR8EU/JxZnJQ5IU
                                        MD5:52B30DA28E218397BF0F197CD012BFE4
                                        SHA1:682C77DD610B00FEB531C9229DFD06597E31D056
                                        SHA-256:43DC75F64615B1D390CDE8CE4367AF134CA91910EB9C93FE821F83DACB3BC893
                                        SHA-512:B4C9074A5E8CB05F2CA92112113BC3246E72E80EDD30C212CEA051F2E361597F1BB468DE07B8C889DF961F067DD6E447C65EFC78C75D265284753127BE1FFBB1
                                        Malicious:false
                                        Preview:from .plugin import HW_PluginBase, HardwareClientBase, HardwareHandlerBase.from .cmdline import CmdLineHandler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\hw_wallet\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1354
                                        Entropy (8bit):4.514970029818741
                                        Encrypted:false
                                        SSDEEP:24:1VZL3NbAa0G4tFi6qXVnDsUlQsXv1rZXrxT:Ll0TelnBXZ7xT
                                        MD5:31CBDC01F67F32923C164021DAAFBA02
                                        SHA1:BE5E95880A57BA0752399391354594D4EEE26EDB
                                        SHA-256:49FF231904D9153C4DEFD35024A69B111E05859D20B8B96C4DB7E6988C46DEDC
                                        SHA-512:8E479BAB7A053FA6A518AA8D925B7C590029866E4A3474A8630A8AD358F3745CF57AEF59B888C1B72DEE6B3A5861514158BDB7983A19257F4D524A645E2788F0
                                        Malicious:false
                                        Preview:from electrum.util import print_stderr, raw_input.from electrum.logging import get_logger..from .plugin import HardwareHandlerBase..._logger = get_logger(__name__)...class CmdLineHandler(HardwareHandlerBase):.. def get_passphrase(self, msg, confirm):. import getpass. print_stderr(msg). return getpass.getpass('').. def get_pin(self, msg, *, show_strength=True):. t = {'a':'7', 'b':'8', 'c':'9', 'd':'4', 'e':'5', 'f':'6', 'g':'1', 'h':'2', 'i':'3'}. print_stderr(msg). print_stderr("a b c\nd e f\ng h i\n-----"). o = raw_input(). try:. return ''.join(map(lambda x: t[x], o)). except KeyError as e:. raise Exception("Character {} not in matrix!".format(e)) from e.. def prompt_auth(self, msg):. import getpass. print_stderr(msg). response = getpass.getpass(''). if len(response) == 0:. return None. return response.. def yes_no_question(self, msg):.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\hw_wallet\plugin.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):14828
                                        Entropy (8bit):4.752524911800716
                                        Encrypted:false
                                        SSDEEP:192:qdwQHddv9pE4nGha4ZDSFDAS67yJO4vCKbewqpcyT2fPWnO/IN20SBjq:roFvG/DovJVdK2m1NO2
                                        MD5:4961B8C84883E8668B0A1E2870BF6C9A
                                        SHA1:31FD90FE0C1BB917C43169545C5601B12C7B4027
                                        SHA-256:05B583AF1AAAB88A008BF0D30EF6713875605CFFB93BDD0C435D91FD785414AD
                                        SHA-512:52B6475FE55BD9B3AA7E5B71DCD79880EC0FFF37670CE2FA403571EE1654803C41BDE627C78B504E99F1A234E2AD7111FE05FF022C8FBDA14AABBA52DC9D1BE6
                                        Malicious:false
                                        Preview:#!/usr/bin/env python2.# -*- mode: python -*-.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2016 The Electrum developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY C

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\hw_wallet\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):12498
                                        Entropy (8bit):4.757921295230046
                                        Encrypted:false
                                        SSDEEP:192:fdwQHdEXHvK0ceFB/KKMDcsfJ+Fkclm82FE8:moaXhFB/WDGFkX82+8
                                        MD5:53D4E492727BAD18D344E2CC928102BE
                                        SHA1:8D55EF3E4620EC8161C22CA1273B05CAD78434E2
                                        SHA-256:0B33414FC749DE7F7D36E5B46DE6DF6E90BC6B74EB84D32CE911D77A1E74852E
                                        SHA-512:D63345E2EAE2624C3E35A95E2193EE1B2ED3DAFD8DB9F4B0D0BA9171533F7446CFE37DCC9D9EF1D988156852C46E405EE349E565F40DCEAFD488C6E484025830
                                        Malicious:false
                                        Preview:#!/usr/bin/env python3.# -*- mode: python -*-.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2016 The Electrum developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY C

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):268
                                        Entropy (8bit):4.8235012599608265
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhkAtml6IFwoGSXBnAJaCwKNQo6KcB4WGVrIeCM7in:1YvQJU6VoHB+a/2cBBGV0dM+n
                                        MD5:94FF5D020EE819D7986259DC69CBE476
                                        SHA1:CB9E3A7C1955A5836299F31ABCC6447B0C9F059C
                                        SHA-256:95C1142F731D619652DB103AB62EE229635073CBEE3878804458B1DD9D1359CF
                                        SHA-512:D0F0B7A192FD2F7927445E48842C8C9041BCBC0E8CB122F30A3539BC86D10A46FD3962588C38629B3E64D305D06AFFF087E7F06CBEEC190A6E45A326ABEFBAA8
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Blockstream Jade Wallet'.description = 'Provides support for the Blockstream Jade hardware wallet'.#requires = [('', 'github.com/')].registers_keystore = ('hardware', 'jade', _("Jade wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):392
                                        Entropy (8bit):4.463179374677607
                                        Encrypted:false
                                        SSDEEP:12:1KM82Jco7+85zO2Hvsb/aCTATSvehahBNA099a/:1/46Hvsb/aC9sahfA0y/
                                        MD5:F5C6F4BA4953FAFB51A4B7114E9F1D6D
                                        SHA1:6D4D4029C28416520D82788C72FC9018510697CF
                                        SHA-256:89FF53B27FE9B3308E8713925EF92B92C4896196134D9EF1F9FFA78C1AF0D83A
                                        SHA-512:D4A6C9340E7CB9B6CBE4B7F82E2D9FFA026A24B98F47D088F406AC185B19A584BB1DDB91FB11916F66D5D5FB6A628E7B3E8FB9EB73429C17DD58E0E401BDBAD8
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .jade import JadePlugin.from ..hw_wallet import CmdLineHandler..class Plugin(JadePlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jade.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Objective-C source, ASCII text
                                        Category:dropped
                                        Size (bytes):20012
                                        Entropy (8bit):4.605564270785093
                                        Encrypted:false
                                        SSDEEP:192:0pjCMMNzjZxMYDVKnP0dCHfHElhTu8HPHlRN5tD9c/cnEYPlNDc9GR8JDq+mHLVu:1F9PHxiCEoM9GR8kceuXd829mBQ
                                        MD5:F9D7283439EB46A7F3E2BB0B16F5A552
                                        SHA1:F0D4A307EF71421957411B28F2E16B45AC419989
                                        SHA-256:F21458090D738DB78BE55AEF43F4EB4827FF570604E21878736C9A014116190A
                                        SHA-512:F0F9E16E9248DB189B8B86141FEDB89CE38328CACCA8421EFCF05EC27A17071994F3DC5C52B45EA885288F3223D2F14D34BEEDBB99F5C08EF8E63013FBEC54AE
                                        Malicious:false
                                        Preview:import os.import base64.import json.from typing import Optional, TYPE_CHECKING..from electrum import bip32, constants.from electrum.crypto import sha256.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.transaction import Transaction.from electrum.wallet import Multisig_Wallet.from electrum.util import UserFacingException.from electrum.logging import get_logger.from electrum.plugin import runs_in_hwd_thread, Device.from electrum.network import Network..from electrum.plugins.hw_wallet import HW_PluginBase, HardwareClientBase.from electrum.plugins.hw_wallet.plugin import OutdatedHwFirmwareException..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)..#import logging.#LOGGING = logging.INFO.#if LOGGING:.# logger = logging.getLogger('jade').# logger.setLevel(LOGGING).# device_logger = logging.getLogger('jade-device').# device_logger.setLevel(LOGGING)

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jadepy\README.md

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):477
                                        Entropy (8bit):4.828758399992962
                                        Encrypted:false
                                        SSDEEP:12:lNQvTNJMaRaEFe13FksD7+8yC1hGQ7VWzFs9zBYo:lyvTyqaksDCfCCiyOVBR
                                        MD5:75DD2797E93EAD1742A774920FDD14F8
                                        SHA1:85FC59323948E8D4DA50571F25AA8E8E9CD3A226
                                        SHA-256:7AE641BADDE92ABFFF7CD61769574CB2E3997CE9E6ACF7ADA5D67780974DDA23
                                        SHA-512:1F5AEA6A5FDC9B0882D2E5786B7A5B8980A6926BCBA3E0AF40691AD8789E0314CA76487A903E6A1EB72588CB1DBC38C4ECC68DB82DBBF02EF68BAD2A3E6EBC1D
                                        Malicious:false
                                        Preview:# Python Jade Library..This is a slightly modified version of the official [Jade](https://github.com/Blockstream/Jade) python library...This modified version was made from tag [1.0.29](https://github.com/Blockstream/Jade/releases/tag/1.0.29)...Intention is to fold these modifications back into Jade repo, for future api release...## Changes.- Removed BLE module, reducing transitive dependencies.- _http_request() function removed, so cannot be used as unintentional fallback.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jadepy\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):83
                                        Entropy (8bit):4.356008886282579
                                        Encrypted:false
                                        SSDEEP:3:1LPHJivNDZLP4XYXRvSw1AXLvHd:1LPcvRZLP4qvSw129
                                        MD5:F8686A13EDF81D1653C8645C5EBE4F20
                                        SHA1:E071EFD7E0EFA22DE7605157591C2B242B96315E
                                        SHA-256:DBAE5D8E80228D433FB80C02750AE17B0D329F6DCCFB880775A4794530CE4517
                                        SHA-512:7F600D316486ED3E7AD937021B92B3B1FBD9CE7E8FBFAC6ED901DB60481C493F05CE9E007CD46760EFF693C44CCFAB5D5D5FA581F85DF876F54CADCF8185593D
                                        Malicious:false
                                        Preview:from .jade import JadeAPI.from .jade_error import JadeError..__version__ = "0.2.0".

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jadepy\jade.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):79303
                                        Entropy (8bit):4.3460139233710935
                                        Encrypted:false
                                        SSDEEP:1536:ZpEvUPU4m9VpPTpb1z9biNDXi5Fe5Y5cjI753jIF58P4Q:ZpEsPUN9V3hz9biZXi5Fe5yCM7
                                        MD5:FE29B974BC72B2282AE49C509D90E234
                                        SHA1:96360F8510FE8FF6C3518C3618BBA3712D85ACA1
                                        SHA-256:8A2F9B549A59BC975E8508082008F17DC8279C7C8EEF8CAEF55CF5F7BE672C41
                                        SHA-512:F586D63C4B93192D67A85815BEDDA52BD571D9B43502DBD70788A958B56993E6C899F0C286E6A777B7454D9E8C03EE871A920A284FD9673CBDEE7286FFA424A1
                                        Malicious:false
                                        Preview:import cbor2 as cbor.import hashlib.import json.import time.import logging.import collections.import collections.abc.import traceback.import random.import sys..# JadeError.from .jade_error import JadeError..# Low-level comms backends.from .jade_serial import JadeSerialImpl.from .jade_tcp import JadeTCPImpl..# 'jade' logger.logger = logging.getLogger(__name__).device_logger = logging.getLogger(f'{__name__}-device')..# BLE comms backend is optional.# It relies on the BLE dependencies being available.try:. from .jade_ble import JadeBleImpl.except ImportError as e:. logger.warning(e). logger.warning('BLE scanning/connectivity will not be available')...# Default serial connection.DEFAULT_BAUD_RATE = 115200.DEFAULT_SERIAL_TIMEOUT = 120..# Default BLE connection.DEFAULT_BLE_DEVICE_NAME = 'Jade'.DEFAULT_BLE_SERIAL_NUMBER = None.DEFAULT_BLE_SCAN_TIMEOUT = 60...def _hexlify(data):. """. Helper to map bytes-like types into hex-strings. to make for prettier message-logging...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jadepy\jade_error.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):655
                                        Entropy (8bit):4.853248167454973
                                        Encrypted:false
                                        SSDEEP:12:ircH+wToOd/kVka5OE1IZtsNXOXGk7O+3Lp1ASpBmkQbnDBVFHwBobLClWi5PJQ:eOoOdxa5o2NWL3HAJDnjRfCt5m
                                        MD5:57A66152722C693FA838635A8E12EB69
                                        SHA1:6480550846EFE74DBBDE6443EB7E119932F6D523
                                        SHA-256:A50A952A33A1924CC9E26FE465270ECFCB21E3D5F55FF3B3E69E697BD0790CBD
                                        SHA-512:04B401EDB9DC82F6DA202E56BEC6685754797AB915E9DFB6710C21FC2E32D22D0FA8FAC7F0E3FF49CDD65D9404106078EF97C74621A87B53754EB3B7E2DE403E
                                        Malicious:false
                                        Preview:class JadeError(Exception):. # RPC error codes. INVALID_REQUEST = -32600. UNKNOWN_METHOD = -32601. BAD_PARAMETERS = -32602. INTERNAL_ERROR = -32603.. # Implementation specific error codes: -32000 to -32099. USER_CANCELLED = -32000. PROTOCOL_ERROR = -32001. HW_LOCKED = -32002. NETWORK_MISMATCH = -32003.. def __init__(self, code, message, data):. self.code = code. self.message = message. self.data = data.. def __repr__(self):. return "JadeError: " + str(self.code) + " - " + self.message \. + " (Data: " + repr(self.data) + ")".. def __str__(self):. return repr(self).

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jadepy\jade_serial.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):2409
                                        Entropy (8bit):4.522427183467439
                                        Encrypted:false
                                        SSDEEP:48:Y2qGafD6PkzvZOP3tRV+LvMjzU+JRRxgEpIXZCjSajDSajVaLcz:JC64ZOlKL0jwWjKskwjSaPSa5awz
                                        MD5:540D0596B313F4AEE4A3C2C79474F54A
                                        SHA1:EF797F0D318B405CAC21FDE31DACEF51C2A110CA
                                        SHA-256:607F28362D02D11AE7F6A0A6BF27DA4473D0753301131C6CC78DB0EC96306C0B
                                        SHA-512:CEAB738896C45E095759DEEFF50862A0611C57363248F110764D1AC69F68205117FFF398FEA4ACFC328ED353B04A69FDD5FC227EE50AD263644D0C37DD4FD126
                                        Malicious:false
                                        Preview:import serial.import logging..from serial.tools import list_ports..logger = logging.getLogger(__name__)...#.# Low-level Serial backend interface to Jade.# Calls to send and receive bytes over the interface..# Intended for use via JadeInterface wrapper..#.# Either:.# a) use via JadeInterface.create_serial() (see JadeInterface).# (recommended).# or:.# b) use JadeSerialImpl() directly, and call connect() before.# using, and disconnect() when finished,.# (caveat cranium).#.class JadeSerialImpl:. # Used when searching for devices that might be a Jade/compatible hw. JADE_DEVICE_IDS = [. (0x10c4, 0xea60), (0x1a86, 0x55d4), (0x0403, 0x6001),. (0x1a86, 0x7523), (0x303a, 0x4001), (0x303a, 0x1001)].. @classmethod. def _get_first_compatible_device(cls):. jades = []. for devinfo in list_ports.comports():. if (devinfo.vid, devinfo.pid) in cls.JADE_DEVICE_IDS:. jades.append(devinfo.device).. if len(jades) > 1:.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\jadepy\jade_tcp.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1797
                                        Entropy (8bit):4.658503094088295
                                        Encrypted:false
                                        SSDEEP:24:xPOaVpKF8JP3B1fSlxAfCK0nX5mYcgvYD0fAh7uwZSq6Q:xGafDJPHSLvKIX56JD2AcwZSqP
                                        MD5:0E15909E3B79C998D5682057CFC2AB82
                                        SHA1:6C26C4C84492A523D0589EEC3F3A61AD57080FAF
                                        SHA-256:9EA17CF844FE568B2ADD6615CBC52C2079711D1740147FA3FB8DF2C6EEC8776F
                                        SHA-512:DEEB72938BC0ACF705E2EBFF39054BDEE338181F5A1468387EB442DDD31FF14D4ACD0CB09CF1B437F74B1D60DF6801C71FB2A1FDC1A4D1B01FCD8D8D20D39260
                                        Malicious:false
                                        Preview:import socket.import logging...logger = logging.getLogger(__name__)...#.# Low-level Serial-via-TCP backend interface to Jade.# Calls to send and receive bytes over the interface..# Intended for use via JadeInterface wrapper..#.# Either:.# a) use via JadeInterface.create_serial() (see JadeInterface).# (recommended).# or:.# b) use JadeTCPImpl() directly, and call connect() before.# using, and disconnect() when finished,.# (caveat cranium).#.class JadeTCPImpl:. PROTOCOL_PREFIX = 'tcp:'.. @classmethod. def isSupportedDevice(cls, device):. return device is not None and device.startswith(cls.PROTOCOL_PREFIX).. def __init__(self, device, timeout):. assert self.isSupportedDevice(device). self.device = device. self.timeout = timeout. self.tcp_sock = None.. def connect(self):. assert self.isSupportedDevice(self.device). assert self.tcp_sock is None.. logger.info('Connecting to {}'.format(self.device)). self.tcp_s

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\jade\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1957
                                        Entropy (8bit):4.929104544059974
                                        Encrypted:false
                                        SSDEEP:48:GrmoSFmmxbjC6uT0OOvCr/3P5yfKwvdRBRWSBhtR5qvT:Emhju0UDByBXBBhtnqb
                                        MD5:C7BD3F19C3E127B8E80154D13C5D1AC6
                                        SHA1:F572850A7796535350168B0DED273601CB8D2A22
                                        SHA-256:9EB8DC82A40FFA87E6FE4E0BAA078300DBE99C1E3E0A0C564B0A243311A849E3
                                        SHA-512:59FD1AE49AAC47B9ABD421EAB8E92C9DB7E66F87DB35DE1EBADBE0F8BC4C934E43A3753F43F5D09E50F99BF03D05931AED6FA7BAA8A2B64E5DFC1976B150C108
                                        Malicious:false
                                        Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet import plugin.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUnlock, WCHWXPub, WCHWUninitialized..from .jade import JadePlugin..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(JadePlugin, QtPluginBase):. icon_unpaired = "jade_unpaired.png". icon_paired = "jade.png".. def create_handler(self, window):. return Jade_Handler(window).. @plugin.only_hook_if_libraries_available. @hook. def receive_menu(self, menu, addrs, wallet):. if type(wallet) is not Standard_Wallet:. return. keystore = wallet.get_keystore(). if type(keystore) == self.keystore_class and len(add

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\keepkey\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):278
                                        Entropy (8bit):4.821030196603601
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rh2kv6IFpy3aOtA8ocvfPiQCwKNQo6Ku1lXoWGVrIeCM7in:1YvQJ2a6IyqOtRocvfPiQ/2u1lXRGV09
                                        MD5:2D76E42E310E58826CAD4056848CF239
                                        SHA1:F6708F9012B5392B24BA550D9E56FC0A39E20AC6
                                        SHA-256:04EDF5BBE67D915C59089E4CFA3A024C0B935D2CB79D6A1D19421D4B820F3A32
                                        SHA-512:5EEA97C182C07425E10EEB7F4BAD05D6D9276D91F4874AD87B43368C24680E41C798BD1B06EFF7B8592D89C6148AF5A610C4D61C27FDD73AB363292221B16F8B
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'KeepKey'.description = _('Provides support for KeepKey hardware wallet').requires = [('keepkeylib','github.com/keepkey/python-keepkey')].registers_keystore = ('hardware', 'keepkey', _("KeepKey wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\keepkey\client.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):528
                                        Entropy (8bit):4.608127851066862
                                        Encrypted:false
                                        SSDEEP:12:1ti9PRXZI6ZVc0F2PVcoI90x1AF9AJnIyAJ9cDA6Jn4YJIAKgcVPf:1tiLpBF2PVsuAF9APAbYA6JnPif
                                        MD5:737BCE725B560E515F20EB78E709C52B
                                        SHA1:1B80436158FCD7C20E94E9F524DD8149FCBA9F4F
                                        SHA-256:CEF7C998629FA73AD4CF51F0F1DFA58446E1369DFEAA19FBDA87097CA42D1B6B
                                        SHA-512:592BFB18211BDE040FCD8CEA13F06A28142059B1C0D43649EC62C92CC9469C8148300AF1E34BA0AEBA1F0F06B0D4B5E8CB2E6EDD2E385023D2A8EE89200CDFD9
                                        Malicious:false
                                        Preview:from keepkeylib.client import proto, BaseClient, ProtocolMixin.from .clientbase import KeepKeyClientBase..class KeepKeyClient(KeepKeyClientBase, ProtocolMixin, BaseClient):. def __init__(self, transport, handler, plugin):. BaseClient.__init__(self, transport). ProtocolMixin.__init__(self, transport). KeepKeyClientBase.__init__(self, handler, plugin, proto).. def recovery_device(self, *args):. ProtocolMixin.recovery_device(self, False, *args)...KeepKeyClientBase.wrap_methods(KeepKeyClient).

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\keepkey\clientbase.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):10023
                                        Entropy (8bit):4.498583976268572
                                        Encrypted:false
                                        SSDEEP:192:C4ttM/vCo5J11DkuY6yAlvegqD2B0oyCGOyiwvt:3tEvM40D2WoyDXb
                                        MD5:4969BD8849EE7B2BB2B86C6866616FAE
                                        SHA1:3D749ABD433B407A577752520CB781A3A68FD043
                                        SHA-256:A267A398D357E2FE3D31C10E975716913924561A0FCA029AFED309A305DE3508
                                        SHA-512:C81DB92B001AAC7C9C9853E978BF589A60AFE476659ABF0922ECF6ADC7A9560A74C8D7A4CC0A917600897AD6291C63DD3A557C5C2B983C0F5C1AEF3652FFDC72
                                        Malicious:false
                                        Preview:import time.from struct import pack.from typing import Optional..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import HardwareClientBase, HardwareHandlerBase...class GuiMixin(object):. # Requires: self.proto, self.device. handler: Optional[HardwareHandlerBase].. messages = {. 3: _("Confirm the transaction output on your {} device"),. 4: _("Confirm internal entropy on your {} device to begin"),. 5: _("Write down the seed word shown on your {}"),. 6: _("Confirm on your {} that you want to wipe it clean"),. 7: _("Confirm on your {} device the message to sign"),. 8: _("Confirm the total amount spent and the transaction fee on your ". "{

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\keepkey\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):4.468576579494682
                                        Encrypted:false
                                        SSDEEP:12:1KM82T6ZVE+857AAyn2Hvsb/aCTATSvehahBNA099a/:1/TSzw82Hvsb/aC9sahfA0y/
                                        MD5:30E746E99CABA2DD38EFBF677668B08C
                                        SHA1:728CF6052FCBD8505FF30DEB811338099A11BAE3
                                        SHA-256:572B3024F467EB5606F89D7C48C72005178537A1D8AA4BD18008A2AED2A0826F
                                        SHA-512:930011E39A6C68E6D367292D009D2CEF37927BDBE732DE579D42E86305CE60DF4132689D9EAC0A9E15E5F15C261D3000222B5997599506C0B03C7F49DEF2B91E
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .keepkey import KeepKeyPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(KeepKeyPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\keepkey\keepkey.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):18435
                                        Entropy (8bit):4.497557488972594
                                        Encrypted:false
                                        SSDEEP:192:4InEP87YTnl+DaeGInJq7ZBQUQmAUo3h4qbIOvlzoVOD7ZwcPnCkjVCK5P+F1J:REE7Yl+wA3IOX3Wgnp0EK
                                        MD5:3179FED1DC739CB21AB7567C24A1CDD4
                                        SHA1:075756B8A4F620F526A11B13D82BE761AAC668A1
                                        SHA-256:F7DF6248C7C7E305189975C2B1200BCE781527DA6CE8EB5E7B4EAB6D36805756
                                        SHA-512:FFC1D27D3C1BEA3EBE4C82A772E70AC36DB061E42C1BB89AA616421AC7CEE7B0FA1453CFAAD989CADBA642FF06BE4230971185FFBF16D1CAD5E45F412A51D390
                                        Malicious:false
                                        Preview:from typing import Optional, TYPE_CHECKING, Sequence..from electrum.util import UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore.from electrum.plugin import Device, runs_in_hwd_thread..from ..hw_wallet import HW_PluginBase.from ..hw_wallet.plugin import is_any_tx_output_on_change_branch, trezor_validate_op_return_output_and_get_data..if TYPE_CHECKING:. import usb1. from .client import KeepKeyClient. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard...# TREZOR initialization methods.TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY = range(0, 4)...class KeepKey_KeyStore(Hardware_KeyStore):. hw_type = 'keepkey'. device = 'KeepKey'.. plugin: 'KeepKeyPlugin'.. def decrypt_message(self, sequence, messag

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\keepkey\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):29123
                                        Entropy (8bit):4.644533633229949
                                        Encrypted:false
                                        SSDEEP:768:LbK1gtqeyIERy5vVSjlmmvi4wJa4z1xKXxVIz:LbKeRyIERy59SjlmSi4Ma4z1xKXT0
                                        MD5:28A6682EC9A4BC4590A28DCA6E01A9D4
                                        SHA1:D34C9E90D74B75C7BB261E3DD76171799A79C220
                                        SHA-256:71EAE26CA283109E3F98D9757A72D4CA82ACBC7F86B998BD293DB2A0A85D5856
                                        SHA-512:A20EB7B082AEDADF88EF77CF1ACE3D48F4D254FB35AE833438C5003CAAEF0DF20C44B0AC01211599488D6A75CD758F53FC2FE9B9943D62FAF886E7042A8401CE
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QEventLoop, pyqtSignal, QRegExp.from PyQt5.QtGui import QRegExpValidator.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox, QDialog,. QTextEdit, QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QSlider, QTabWidget)..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, ChoiceWidget).from electrum.i18n import _.from electrum.plugin import hook.from electrum.logging import Logger..from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from .keepkey import KeepKeyPlugin, TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY..from electrum.gui.qt.wizard.wallet import WCScriptAndDeriv

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\labels\Labels.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):976
                                        Entropy (8bit):4.266424000445255
                                        Encrypted:false
                                        SSDEEP:24:I60KUhGhBlgaXgne6DqtnRIqmAzA1cmPcr4c1UL:I60KUhGblh16Otnv3k1re4XL
                                        MD5:63333160BA67AB698C70BDA33EB05C36
                                        SHA1:0EC3C196CF478AA9DA3BA909E0E748492E4DF860
                                        SHA-256:D61F0650C154C214B5235DC7AA6D75435B25C3642E1E84823BEA864493F5B741
                                        SHA-512:4E5D76DF424F2A4E0249F8198DA0531B1A3F326D16A4FF567896FFE7AE1236E895B56877A24C572169C490426E82E834AB81677225DB624FEEC89D9FF2F865A9
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.14.import QtQuick.Controls.Material 2.0..import org.electrum 1.0..//import "controls"..Item {. width: parent.width. height: rootLayout.height.. property QtObject plugin.. RowLayout {. id: rootLayout. Button {. text: 'Force upload'. enabled: !plugin.busy. onClicked: plugin.upload(). }. Button {. text: 'Force download'. enabled: !plugin.busy. onClicked: plugin.download(). }. }.. Connections {. target: plugin. function onUploadSuccess() {. console.log('upload success'). }. function onUploadFailed() {. console.log('upload failed'). }. function onDownloadSuccess() {. console.log('download success'). }. function onDownloadFailed() {. console.log('download failed'). }. }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\labels\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):353
                                        Entropy (8bit):4.662360886198234
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhtg9bOsxY3/PbdoBdkAFcmFkM/AYXMDGeh0or1fmCFfgy3mPGVrIeCRI4/:1YvQJ+Rxco0AmmFFvMD/2aeUfiGV0dRn
                                        MD5:21448A626D1CD28546563118CA9AC337
                                        SHA1:ED3E2C021DD395DE0E6C882DCF99E9F243B14D35
                                        SHA-256:A70D9912CC5E610131698A3A38961DD66C735D831A833BEBD7058C50E3CDC112
                                        SHA-512:BC12ABB6B649D5A786A4CA2AA8A2AEBD48CFC944D7DD99A37438FC9AC09DD8F0F371762365411141A1003B8B673811FF8D980C19CF4985BE69BA03142FD767D7
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('LabelSync').description = ' '.join([. _("Save your wallet labels on a remote server, and synchronize them across multiple devices where you use Electrum."),. _("Labels, transactions IDs and addresses are encrypted before they are sent to the remote server.").]).available_for = ['qt', 'qml', 'cmdline']..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\labels\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):271
                                        Entropy (8bit):4.460627159720854
                                        Encrypted:false
                                        SSDEEP:6:1LJyQsOXJKMMIin4BOZCzLM0twRL0JXg3U6IaT/XhMZamv:18QuM8lp0KRUamv
                                        MD5:96C7F006F00DEC601B732FC566A8C9EE
                                        SHA1:031CEBAB7EAECB151C0E777A1FC4FF825638853B
                                        SHA-256:3DC8658B4F1F0FC29C6B889F94713135A9D36B5DFA05252E4D33D343E96A9974
                                        SHA-512:60976A78CCC1632176E1CBAA76073014B3BBD984F6C7D8287580EEDF151C1E027EC41020BAF3E35FEB7E0D8CC7FE2519805E02A6B4F32C86A3664381DD55A798
                                        Malicious:false
                                        Preview:from .labels import LabelsPlugin.from electrum.plugin import hook..class Plugin(LabelsPlugin):.. @hook. def load_wallet(self, wallet, window):. self.start_wallet(wallet).. def on_pulled(self, wallet):. self.logger.info('labels pulled from server').

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\labels\labels.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):8160
                                        Entropy (8bit):4.481185503293974
                                        Encrypted:false
                                        SSDEEP:96:qfpwF+mxbhqAGWG4oPUXwzRYcYXfLUw7X3bmQHu1AnJGHVOz0Sma3d1Ko5q:qfXC8gv9vmCZcYz0k8
                                        MD5:9718897C830CD910B320453624FAB3E0
                                        SHA1:993297EF438553F6E77E5682F9E4FCDF685743C3
                                        SHA-256:96A7FA4C6244019B4B13F44982B6300179E420769A662F9A50A541035AA09757
                                        SHA-512:516E0FA5010A844B2731929F8E024073530D6A517D1CA5EBB0BE3DE800CB80FC9E282F4DDAF951F279C4BFACFBD4980F6B79124659AFA6F7F23DBE2F1AFBF070
                                        Malicious:false
                                        Preview:import asyncio.import hashlib.import json.import sys.import traceback.from typing import Union, TYPE_CHECKING..import base64..from electrum import util.from electrum.plugin import BasePlugin, hook.from electrum.crypto import aes_encrypt_with_iv, aes_decrypt_with_iv.from electrum.i18n import _.from electrum.util import log_exceptions, ignore_exceptions, make_aiohttp_session.from electrum.network import Network..if TYPE_CHECKING:. from electrum.wallet import Abstract_Wallet...class ErrorConnectingServer(Exception):. def __init__(self, reason: Union[str, Exception] = None):. self.reason = reason.. def __str__(self):. header = _("Error connecting to {} server").format('Labels'). reason = self.reason. if isinstance(reason, BaseException):. reason = repr(reason). return f"{header}: {reason}" if reason else header...class LabelsPlugin(BasePlugin):.. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, con

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\labels\qml.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):4142
                                        Entropy (8bit):4.383682861028925
                                        Encrypted:false
                                        SSDEEP:96:jcmMppNvgN3t97NE9q7vIbYg37QeBfBYhB:YZp1ioDRhGhB
                                        MD5:080032F17E18E29FC7C25CC5B9AB1382
                                        SHA1:6B1A86637A697BD9A8A63D9788C36B6954837D1D
                                        SHA-256:9C436F742E50C1E7602DA5EEF3D31BDCB996A0DEBDC4531E18F7F53501DD77E5
                                        SHA-512:92142E61A92FD560752531CD067A60AD220048C91A95599D4D97513D7532E705875FBCA389BBC9B698EE05907445606E8ABDC33D6F6E43F97D8C893381DC540C
                                        Malicious:false
                                        Preview:import threading..from PyQt6.QtCore import pyqtSignal, pyqtSlot..from electrum.i18n import _.from electrum.plugin import hook..from electrum.gui.qml.qewallet import QEWallet.from electrum.gui.common_qt.plugins import PluginQObject..from .labels import LabelsPlugin...class Plugin(LabelsPlugin):.. class QSignalObject(PluginQObject):. labelsChanged = pyqtSignal(). uploadSuccess = pyqtSignal(). uploadFailed = pyqtSignal(). downloadSuccess = pyqtSignal(). downloadFailed = pyqtSignal().. _name = _('LabelSync Plugin').. def __init__(self, plugin, parent):. super().__init__(plugin, parent).. @pyqtSlot(result=str). def settingsComponent(self): return '../../../plugins/labels/Labels.qml'.. @pyqtSlot(). def upload(self):. assert self.plugin.. self._busy = True. self.busyChanged.emit().. self.plugin.push_async().. def upload_finished(self, result):.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\labels\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3613
                                        Entropy (8bit):4.632841276996006
                                        Encrypted:false
                                        SSDEEP:96:gqm6FOZvbgrjd0jbvjhX34df9xJ96X1Jp:gqhqLjh44X3p
                                        MD5:31E333482CBF6401028D4CFF6E807307
                                        SHA1:75F2CB9A3F425A4064057946D5D2F1C7E222ED07
                                        SHA-256:5EBDD56C0E9BEAC63935D957AE145117D01F7EE0DE779C45C6D72F32FC48834F
                                        SHA-512:26C95AF6EE071C1EDB8E273BC245EEA251F383D580F8B35B7E24AF5A3FE8BDC7D5F85FB4A5C0DF89E014145F1AC8B9B12F14D3914143B109024C78B9669E3887
                                        Malicious:false
                                        Preview:from functools import partial.import traceback.import sys.from typing import TYPE_CHECKING..from PyQt5.QtCore import QObject, pyqtSignal.from PyQt5.QtWidgets import (QHBoxLayout, QLabel, QVBoxLayout)..from electrum.plugin import hook.from electrum.i18n import _.from electrum.gui.qt.util import ThreadedButton, Buttons, EnterButton, WindowModalDialog, OkButton..from .labels import LabelsPlugin..if TYPE_CHECKING:. from electrum.gui.qt import ElectrumGui. from electrum.gui.qt.main_window import ElectrumWindow. from electrum.wallet import Abstract_Wallet..class QLabelsSignalObject(QObject):. labels_changed_signal = pyqtSignal(object)...class Plugin(LabelsPlugin):.. def __init__(self, *args):. LabelsPlugin.__init__(self, *args). self.obj = QLabelsSignalObject(). self._init_qt_received = False.. def requires_settings(self):. return True.. def settings_widget(self, window: WindowModalDialog):. return EnterButton(_('Settings'),.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\ledger\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):285
                                        Entropy (8bit):4.84363630841645
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhqA0Opml6IFCKkJMKNzEmGgvXwKNQo6KcbJZH+WGVrIeCM7in:1YvQJqLt68/KNgt2aRGV0dM+n
                                        MD5:93C97180066580C721162F2D8A58D0E8
                                        SHA1:A65514D33C88A9A4EBABD81D41C93111177D75EE
                                        SHA-256:D9D094304691A391B0DB294F4741C8F838B07BA821E70E98EC8AB2433AC8484B
                                        SHA-512:D42647048E9CA3A597FF776A55A1D1C7FED3968826E1DF91126029A2A13A9B7930C5B66B9B3F3B2EB8F417E50895A2EB8E8983680B68B4EAEEDA407C34295B96
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Ledger Wallet'.description = 'Provides support for Ledger hardware wallet'.requires = [('ledger_bitcoin', 'github.com/LedgerHQ/app-bitcoin-new')].registers_keystore = ('hardware', 'ledger', _("Ledger wallet")).available_for = ['qt', 'cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\ledger\auth2fa.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):7022
                                        Entropy (8bit):4.747407652681403
                                        Encrypted:false
                                        SSDEEP:192:1JAljLvMF9F0tNyydkVHSMEdUoavFfbpGPQS:SjAF9F0tNyydGSMEdUoavFfbpGPQS
                                        MD5:9C1C046D745D8B69FAAD6816ECC3CDC3
                                        SHA1:A533767A31D529B7D474DBEFC20DFF760262C276
                                        SHA-256:37AAFAF43AA20413B58BA98144BD6DD0C9D392815B7FE8768D873C8FB170A353
                                        SHA-512:3464005E9FC850E9E317F4002E3D265DDB1BD54885C6FDE74D9D06F3965E333CB4068504A8C5659E2A3860327C328A74A3C5F3EE4FC8C9FE39CC584BA5AE1458
                                        Malicious:false
                                        Preview:import copy.from typing import TYPE_CHECKING..from PyQt5.QtWidgets import (QDialog, QLineEdit, QTextEdit, QVBoxLayout, QLabel,. QWidget, QHBoxLayout, QComboBox)..from btchip.btchip import BTChipException..from electrum.gui.qt.util import PasswordLineEdit..from electrum.i18n import _.from electrum import constants, bitcoin.from electrum.logging import get_logger..if TYPE_CHECKING:. from .ledger import Ledger_Client..._logger = get_logger(__name__)...DEBUG = False..helpTxt = [_("Your Ledger Wallet wants to tell you a one-time PIN code.<br><br>" \. "For best security you should unplug your device, open a text editor on another computer, " \. "put your cursor into it, and plug your device into that computer. " \. "It will output a summary of the transaction being signed and a one-time PIN.<br><br>" \. "Verify the transaction summary and type the PIN code here.<br><br>" \. "Before pressing enter, plug the

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\ledger\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):398
                                        Entropy (8bit):4.436105371577658
                                        Encrypted:false
                                        SSDEEP:12:1KM82Zaw+85vz2Hvsb/aCTATSvehahBNA099a/:1/UP+qHvsb/aC9sahfA0y/
                                        MD5:6AFC46764F78CB549913211C932ABF9E
                                        SHA1:AD5BBE48D36EB947D6D3BFAF629A407D8DEF8E53
                                        SHA-256:F8860C9DE94C9E8058DA2B03755AE236BC0574BE21510B05B600F085CAFA5A1C
                                        SHA-512:BC559EA11527864E6B9E02E3AFE93B74ED6359E2EA5558153DC5F3A3A153F1BFAD4E265242B85EF409CC7838FAF41ACFC433ABF088D0E876098CA2DDF7BE46C8
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .ledger import LedgerPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(LedgerPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\ledger\ledger.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):60739
                                        Entropy (8bit):4.547634742971814
                                        Encrypted:false
                                        SSDEEP:384:5ud/kX6YVXmoY1UlHh2cRSOJL8rORuX/kkfShCMUlRUWaMjVuSkKKrbeANAeYc19:5udI6YVXmyHDI6d8UW7pwdF0Chfr
                                        MD5:09FDFBFA65B3413360649253DFF7F224
                                        SHA1:048E41B2555C8630A7A9AD5AC0AE2DAEA0F13C35
                                        SHA-256:4FF95014814EEF52F85EC80E45F36E311CCEAF55F584E6E7162C0F50CE5E748B
                                        SHA-512:098C6E5EF2D0C78B3BAC4FF9D18F8D8B900FF03D3A012D6C9E94023C1663B8C6573BD6F8FD63634459180BA3BE915D20C10DA7D55095A8E14FA3F4A5F494A539
                                        Malicious:false
                                        Preview:# Some parts of this code are adapted from bitcoin-core/HWI:.# https://github.com/bitcoin-core/HWI/blob/e731395bde13362950e9f13e01689c475545e4dc/hwilib/devices/ledger.py..from abc import ABC, abstractmethod.import base64.import hashlib.from typing import Dict, List, Optional, Sequence, Tuple, TYPE_CHECKING..from electrum import bip32, constants, ecc.from electrum import descriptor.from electrum.bip32 import BIP32Node, convert_bip32_intpath_to_strpath, normalize_bip32_derivation.from electrum.bitcoin import EncodeBase58Check, int_to_hex, is_b58_address, is_segwit_script_type, var_int.from electrum.crypto import hash_160.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.logging import get_logger.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import PartialTransaction, Transaction, PartialTxInput.from electrum.util import bfh, UserFacingException, versiontuple.from electrum.wallet import Standard_Wallet..from ..hw_w

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\ledger\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3240
                                        Entropy (8bit):4.769142883833306
                                        Encrypted:false
                                        SSDEEP:96:CmW40QjLE0UxyM6+CnCtO2eVqQjt9O6JGEY:CrHi3UgMvJhWc
                                        MD5:7E6BB8599322D1619385865EAD965C95
                                        SHA1:B465F07EC88F2DF316EADC726EFC4E151C30F926
                                        SHA-256:7B18956F7F0473E84373DF390A391BE2DF2059173AF6EBC16513FE67B4A2AFB0
                                        SHA-512:49E806AC5BA2F25A183192FD8F2A612E57537A58D3EED458C8A5DA30F3AFB42C735B360654282B3362B9219314CF46605F0918C41968F63DB9BE5A5C27BA22CA
                                        Malicious:false
                                        Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal.from PyQt5.QtWidgets import QInputDialog, QLineEdit..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet..from .ledger import LedgerPlugin, Ledger_Client.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUninitialized, WCHWUnlock, WCHWXPub..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(LedgerPlugin, QtPluginBase):. icon_unpaired = "ledger_unpaired.png". icon_paired = "ledger.png".. def create_handler(self, window):. return Ledger_Handler(window).. @only_hook_if_libraries_available. @hook. def receive_menu(self, menu, addrs, wallet):. if type(wallet) is not Standard_Wallet:. return. keystore = wallet.g

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):140
                                        Entropy (8bit):4.653892747944294
                                        Encrypted:false
                                        SSDEEP:3:1ApxQ2MUdLNQK0rbF6qnXMSMZnNbt/8XqXAXMNFVHv66JfWyECbCin:1YvQ7rhC/FFttAcXh3Vrmin
                                        MD5:11E1D2BC564933B59B4619773B50851A
                                        SHA1:76BBB12A3CE6C9A0B5218D91F55AAC0C4FC55021
                                        SHA-256:2C0D9A443E5507125519D120B83E1D8FFA9E11AC4419F42B1658C1F589061D2B
                                        SHA-512:A5AABA08FF268EAB6A87A5A587D28F4DB48062FBF2AE730C87594DD76C4DE703878FFBE340E584C59B7924586004EB242EDCC34F0170F6AD592A53811C37D5BB
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('PayServer').description = 'run a HTTP server for receiving payments'.available_for = ['cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1253
                                        Entropy (8bit):5.155149269351112
                                        Encrypted:false
                                        SSDEEP:24:Uobk4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFUO:UEtJdVlPvLTmawQHlsyHIO5d3D1FZ
                                        MD5:933102C0C6E3280EA5E125F7E91CD578
                                        SHA1:3C369B1F4431537C05AD22D11CC605A3FB46448E
                                        SHA-256:298CD766F61C90F233EF52FFF9BFF848894DE13A088CE856E4E47036F931FEDC
                                        SHA-512:977BBBAB4C327D4BAD43579BD37D91235779C0919C83F215A1C83906AF7C601074510279261D1ED3A437A5D2FDB5160DF6A9B4FCD7D8762F636931A061A3AFC5
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2022 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\payserver.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):6788
                                        Entropy (8bit):4.888160709542598
                                        Encrypted:false
                                        SSDEEP:192:hdwQHdFAfunGGKumBmpbUCmwNbDo7U7D7vG8:soyuBKumBmpbUCmwbDeU7/l
                                        MD5:309E5652E49734690D5958DE50680649
                                        SHA1:752C61C641A377074887EF5747FDD8C56D0EEDF2
                                        SHA-256:BDF81D7311BBAA677BF0692A5C9BDA0B367F3D3FEC1493254EF822DDCA8EF5DE
                                        SHA-512:31B173822BCCECCA143D144F297691F91A2ACCFAD2EAB6257913F34CAA2799CCD8FA3887784EA8FA0C49C854B3EE1668BBDB6C01BE660432BE0169B4C571F494
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2022 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\.editorconfig

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):189
                                        Entropy (8bit):4.603023009803555
                                        Encrypted:false
                                        SSDEEP:3:SMRVYG62mQDMOXKL1vEBALcWj2xJ6PC2o/PgdvS+xFoqq45uIaucWepMik/rJbiZ:SQVYCmQCL1vE2L6Tmw/PiqegavJiedOZ
                                        MD5:57EE98C14EC81A9135983C3E84E8BDDD
                                        SHA1:715BAD219BE2F9D65F82D5914CD9BBE09CF543E4
                                        SHA-256:558BBCF2F0052713B6E479F4EF664E6D5ADBB31F006E42427468670682CDE2FF
                                        SHA-512:EBBC49967798528CEA50663925C5BF536226A213D98122DE8357746A2B6056C4D7E2A48ED97C9E0A6B09C6D9D5674E807BBB0603B4165BBB05AB5ED70ADED1D8
                                        Malicious:false
                                        Preview:# see https://EditorConfig.org..root = true..[*].indent_style = space.trim_trailing_whitespace = true.end_of_line = lf.charset = utf-8..[*.html].indent_size = 4.insert_final_newline = true.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\.git

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):46
                                        Entropy (8bit):3.801815010925754
                                        Encrypted:false
                                        SSDEEP:3:vW5yVC2gtmsAGxQ3hcn:vuteJhcn
                                        MD5:DA9726D60EE6D0B3FFE8FE7E7FFDD02E
                                        SHA1:926DB90A6B37528252D68254EBDA6D4439429192
                                        SHA-256:05A0DB3D8D302F2CB18FDE3FBEBDFC84233AEA1118ED4FFCFE6349A1BB817C53
                                        SHA-512:8AD688712BE8128C9DF39B824666F9987107B6F99F5F701FCE112651463A60DDF1F0230D2285098F8B4BD795EE12DEA010434EE665091F87A849BB6713D7370E
                                        Malicious:false
                                        Preview:gitdir: ../../../../.git/modules/electrum/www.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\.gitignore

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):6
                                        Entropy (8bit):2.584962500721156
                                        Encrypted:false
                                        SSDEEP:3:M5n:M5n
                                        MD5:7A8B085DBF273DE1BB2CB0B44C858F33
                                        SHA1:B9C4D3CFCF0530FA5EE6EACF43499BE4B0FD0505
                                        SHA-256:1D15BDB66E2D42CD0ECDDEB6926D7A97DBF7A82A055067B7B9AFC05112EE0437
                                        SHA-512:D295737DD931415A0071E117C076CA606D9DDCB5760DE461B6FE2C8B884618C68F79B130FBABBA9D53E12B8132422BCCBFFFF014B4CFB4D943A00BF65D9BF229
                                        Malicious:false
                                        Preview:.idea.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\LICENCE

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1156
                                        Entropy (8bit):5.135419459723763
                                        Encrypted:false
                                        SSDEEP:24:TN90gMHiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:rQHiJzfPvGt7ICQH+sfIte36AFD
                                        MD5:6F575409890FC5018003C9DE6F701BB3
                                        SHA1:0E07954FD102EF9D14141BF3932D97F0CFFD9CAC
                                        SHA-256:7E74F53B0182E34D6DBAD47308F8719E947D7A8C4AEF8CBAB35C34B46BA9DF01
                                        SHA-512:0AC8598C3960D7F4221F21546B9EBE45BEA4369A9C84A56FDE7179A56D523AAF45F5903AC5B2353C394A656A83B6221920C088AF65DEAF3EB739F425FE940C8B
                                        Malicious:false
                                        Preview:MIT license (as below), except for the "vendor/" library...-----..The MIT License (MIT)..Copyright (c) 2022 The Electrum developers..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\README.md

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):63
                                        Entropy (8bit):4.277638551759855
                                        Encrypted:false
                                        SSDEEP:3:SstXQ1HvPET/V+LzD0FQJpjRo:SE6Hv8T/V+PD0SbjRo
                                        MD5:7AB347B2A1BB62AA469491E5A3ED02CC
                                        SHA1:5BD896B048174A63E9BE6EE2875A676AE381C309
                                        SHA-256:7CB581F049BD841F91277080976DD973D5781E82F0C7E823FF412BCCFB87022E
                                        SHA-512:CC470C5AD4541F33AB75BE3ACD47FDF7F37FF7E2EB8AA976A7E96A637457F2330428D151E82F428DEE06C5E163AE3464805484032F58338DA0AEDB917CD2AFDD
                                        Malicious:false
                                        Preview:# electrum-http.javascript and html files for payment requests.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\create_invoice.html

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:HTML document, ASCII text
                                        Category:dropped
                                        Size (bytes):1042
                                        Entropy (8bit):4.711894685746978
                                        Encrypted:false
                                        SSDEEP:24:0peYbM78V8EtpWTQzJ0OEhxuBeWsb8np/gT2IA:0TMQV8ipWE0JhAABbQpIy
                                        MD5:362F55B495A98401872518F374786FE5
                                        SHA1:8B22154EC5105D67836BFF52CE1B2DAFD060C1A0
                                        SHA-256:148C5C6C7A22704D789E3DD90AE6A722EDD14485744AE11DC6BDD04A3AC3781A
                                        SHA-512:F9395336914517E21B60544AC7DC086B6BD978FAE3B72BB93B95CF6752F0487DBEBBC3D6C38E09BFBE8B250C4B77034A2CE05441383874AB0659D4892C06D898
                                        Malicious:false
                                        Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <style type="text/css">. body {.. font-family: Arial;. }. form {. }. input {.. border: 2px solid #ccc;.. padding: 12px 20px;. }. </style>. </head>. <body>. <div style="width:30em; margin:auto;">. <p>This is a sample web interface that lets you create on-chain..and lightning invoices to your Electrum wallet. You can use it..with an electrum daemon running on a webserver. The lightning..invoice will be replaced by an error message if your wallet is..disconnected or does not have enough inbound liquidity to..receive the requested amount. The on-chain invoice will not be..displayed if the amount is too small to be received onchain.. </p>. <form method=POST action=/api/create_invoice>..<input name="message" placeholder="description"><br/>..<input type="number" min="1" name="amount_sat" placeholder="amount (satoshis)" ><br/>..<input type="submit" value="Create invoice"><br/>.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\index.html

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:HTML document, ASCII text
                                        Category:dropped
                                        Size (bytes):9691
                                        Entropy (8bit):4.975123909216841
                                        Encrypted:false
                                        SSDEEP:192:uaxDvaDsTawIOxkJsyrbzzpk5NnIJqtPB0UQKL85P6h9GfU9z8yVQ:zLSQyrbX7JqtPiA9Mj
                                        MD5:1681BAE57A7EC0694F7531CF27B17A81
                                        SHA1:4D2F49C78659BC2D8FC20260D8880C1A4E896B16
                                        SHA-256:5DCD17868ECF8FAD6A233305B67889FE8B9F8509947D082A392AB092E0D0C3FC
                                        SHA-512:1D39D107796D61F87E8D69700310F18E7D9018303AFD5BDA85A12A7BC5F2C802C3F97778F2F72AD52264076F240EDCF78C62A0D4EBB32AD7A1834AC4EB378EED
                                        Malicious:false
                                        Preview:<!DOCTYPE HTML>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Payment request</title>. <script type="text/javascript" charset="utf-8" src="vendor/jquery-3.4.1.min.js"></script>. <script type="text/javascript" src="vendor/jquery-ui.min.js"></script>. <script type="text/javascript" src="vendor/qrcode.js"></script>. <link rel="stylesheet" type="text/css". href="vendor/jquery-ui-themes-1.12.1/themes/ui-lightness/jquery-ui.css">. <style type="text/css">.. body {.. font-family: Arial;. }.. .tab {.. overflow: hidden;.. border: 1px solid #ccc;.. background-color: #f1f1f1;. }. .tab button {.. background-color: inherit;.. float: left;.. border: none;.. outline: none;.. cursor: pointer;.. padding: 14px 16px;.. transition: 0.3s;. }. .tab button:hover {.. background-color: #ddd;. }. .tab button.active {.. background-color: #ccc;. }. .tabcontent {.. display

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\pay

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:HTML document, ASCII text
                                        Category:dropped
                                        Size (bytes):9691
                                        Entropy (8bit):4.975123909216841
                                        Encrypted:false
                                        SSDEEP:192:uaxDvaDsTawIOxkJsyrbzzpk5NnIJqtPB0UQKL85P6h9GfU9z8yVQ:zLSQyrbX7JqtPiA9Mj
                                        MD5:1681BAE57A7EC0694F7531CF27B17A81
                                        SHA1:4D2F49C78659BC2D8FC20260D8880C1A4E896B16
                                        SHA-256:5DCD17868ECF8FAD6A233305B67889FE8B9F8509947D082A392AB092E0D0C3FC
                                        SHA-512:1D39D107796D61F87E8D69700310F18E7D9018303AFD5BDA85A12A7BC5F2C802C3F97778F2F72AD52264076F240EDCF78C62A0D4EBB32AD7A1834AC4EB378EED
                                        Malicious:false
                                        Preview:<!DOCTYPE HTML>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Payment request</title>. <script type="text/javascript" charset="utf-8" src="vendor/jquery-3.4.1.min.js"></script>. <script type="text/javascript" src="vendor/jquery-ui.min.js"></script>. <script type="text/javascript" src="vendor/qrcode.js"></script>. <link rel="stylesheet" type="text/css". href="vendor/jquery-ui-themes-1.12.1/themes/ui-lightness/jquery-ui.css">. <style type="text/css">.. body {.. font-family: Arial;. }.. .tab {.. overflow: hidden;.. border: 1px solid #ccc;.. background-color: #f1f1f1;. }. .tab button {.. background-color: inherit;.. float: left;.. border: none;.. outline: none;.. cursor: pointer;.. padding: 14px 16px;.. transition: 0.3s;. }. .tab button:hover {.. background-color: #ddd;. }. .tab button.active {.. background-color: #ccc;. }. .tabcontent {.. display

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-3.4.1.min.js

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (65451)
                                        Category:dropped
                                        Size (bytes):88145
                                        Entropy (8bit):5.291106244832159
                                        Encrypted:false
                                        SSDEEP:1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
                                        MD5:220AFD743D9E9643852E31A135A9F3AE
                                        SHA1:88523924351BAC0B5D560FE0C5781E2556E7693D
                                        SHA-256:0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
                                        SHA-512:6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
                                        Malicious:false
                                        Preview:/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\AUTHORS.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):12660
                                        Entropy (8bit):5.007082424862998
                                        Encrypted:false
                                        SSDEEP:192:CPi9lWCZ2RTCMfvMQAFYw7TFUAcj7uQNtpNA4tDTzrozIwm2vt31YmZ:VaZFkQSf7TFUAuA4c0wm213p
                                        MD5:403511FC6C430EA6179EBCB4A9983EEC
                                        SHA1:131842146D2B11D742A638F42739D7E0741DC026
                                        SHA-256:5B62E1D666C6A373B0734A175FD535F9315549961A0BBD8ABD246BAD1A775082
                                        SHA-512:97BADB94E8028918DB9EA30E3E038C4740941AA2C1BA284CCBC39A26157F771243CFC249F855228DE6DA3B7F7427B2ACD259318C6878F77529EB355762C15284
                                        Malicious:false
                                        Preview:Authors ordered by first contribution.A list of current team members is available at http://jqueryui.com/about..Paul Bakaus <paul.bakaus@gmail.com>.Richard Worth <rdworth@gmail.com>.Yehuda Katz <wycats@gmail.com>.Sean Catchpole <sean@sunsean.com>.John Resig <jeresig@gmail.com>.Tane Piper <piper.tane@gmail.com>.Dmitri Gaskin <dmitrig01@gmail.com>.Klaus Hartl <klaus.hartl@gmail.com>.Stefan Petre <stefan.petre@gmail.com>.Gilles van den Hoven <gilles@webunity.nl>.Micheil Bryan Smith <micheil@brandedcode.com>.J.rn Zaefferer <joern.zaefferer@gmail.com>.Marc Grabanski <m@marcgrabanski.com>.Keith Wood <kbwood@iinet.com.au>.Brandon Aaron <brandon.aaron@gmail.com>.Scott Gonz.lez <scott.gonzalez@gmail.com>.Eduardo Lundgren <eduardolundgren@gmail.com>.Aaron Eisenberger <aaronchi@gmail.com>.Joan Piedra <theneojp@gmail.com>.Bruno Basto <b.basto@gmail.com>.Remy Sharp <remy@leftlogic.com>.Bohdan Ganicky <bohdan.ganicky@gmail.com>.David Bolter <david.bolter@gmail.com>.Chi Cheng <cloudream@gmail.com>.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1817
                                        Entropy (8bit):5.104115525869163
                                        Encrypted:false
                                        SSDEEP:48:UzHtub9kugsniJzfPvGt7ICQH+sfIte36AFdMhw+dEXt4V:uHtyyu2Put0CQHT6fhw+dEXeV
                                        MD5:E0C0D3D883E83F19EFA64FEB54D5F63D
                                        SHA1:15DF6665DFD90F5CD8FDFDE4C0C43051FBB76DAE
                                        SHA-256:DE33FB695880D0B07615D4B86F78CD43796906959ADE5FDFEF70968827A0DB78
                                        SHA-512:9D6477C8BC412206AE4258CB5D260AEDB593F5830F9B539F4A744BB6B9FEA35A1D36D3D82A5731EAE36FFBA1671705EE0CEA499320CC450D74B4F7A2898FA3AD
                                        Malicious:false
                                        Preview:Copyright jQuery Foundation and other contributors, https://jquery.org/..This software consists of voluntary contributions made by many.individuals. For exact contribution history, see the revision history.available at https://github.com/jquery/jquery-ui..The following license applies to all parts of this software except as.documented below:..====..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INC

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_444444_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.919659124224948
                                        Encrypted:false
                                        SSDEEP:192:d0qa5wogj5iPmijz0onp6MYOF6zv/pw5a6a6kIBOI:za5U5yHp6XqCvB96aqOI
                                        MD5:79B89CC07096D272B27EDEFCCE2DA120
                                        SHA1:B19FF112C585040AEDEA7F24BD6A49D611564267
                                        SHA-256:C1D0EE16F6D7056117904C782C1CB6294D1506604F34B77C8B4237672C676DC9
                                        SHA-512:29F81723F15D7164537198C3E8F94366ECFF50D1987B3E5C17B058D82BAD6ABCFF35716C3529D53D0DA05DEAA95E1E55A4F684D4B5B4C482337798FEEFF01BB0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.D.<......tIME......6..F....IDATx..k.%Gu..m;....!.^.....l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S....d.5..x..^.../.2........,..+M..^....O..r..`.:..S.|.{.Y...`...`k?..a...6...1...@..5..S.#.Gd......).q.vX.u.B@.*.J@`H.N...A....1n.:.P..,D:A..q+.=...f.]S..q.!.....+Lm.>|...XhN.^.4.A...3C...J.....`Z.U.=.s.4.....)...-...`F8.i.RY..CP.....C.Z..:...{....p......@........px.h8..4.^...o...;..o2....Y..1m.=...v......E.GJH....i..U.g.>.k.6..R_.}.S..k..=..~5<.e..........n.oF......d{...U.^@...>]..L..-oz.....e..%PE.dR...=.I.l.O\r..6`.S..`...dxup....../........@........px.h8..t.....W.....9........... {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.`

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_555555_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7074
                                        Entropy (8bit):7.928012384219511
                                        Encrypted:false
                                        SSDEEP:96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
                                        MD5:00DD0EC0A16A1085E714C7906FF8FB06
                                        SHA1:244BD9B7C3B1C4F7EF72DE31F67804FAFF213715
                                        SHA-256:5D04051DFD9D2D740355404F98A683D1EC0FEB2FCA7D76E533C1A6E5CE92DD2E
                                        SHA-512:163AFECE9AE9693C41324FFD89191132A8D2E42D73F962ACE0B70B44A17D954C8F506CC25AF152397E2536DA6245E4336AE465708EDF6EDE955B4AD502AF7A71
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.U...I....tIME......6..F....IDATx..{.$G}.?m;....!.>...l.....G$,..&.%.|.........].]..=...?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W.^<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_777620_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.766413362618199
                                        Encrypted:false
                                        SSDEEP:96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
                                        MD5:4E7E3E142F3939883CD0A7E00CABDAEF
                                        SHA1:D20567FD436991539EAFD65C3BDE77D82A656012
                                        SHA-256:9DBE4A0D03FEED6F65EB2560A0A8B4BA4264545EE8FD31C1763A3B219D0328D6
                                        SHA-512:D145A64F637F34D9F9FEFAF7CEF14EA277D0933E16C625234A9C1E0A54A7F3D0D820AB49B4B68D5D3E9853399D74EFBA9FF7771BFD3481F8C1C70E6DC6F50275
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEwv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv .......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME......6..F....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_777777_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.919098640897273
                                        Encrypted:false
                                        SSDEEP:192:3ZL/Hq8z/FyEJ3kJpSiztKi4NkaerdCVHMh:x/HqpEJ3KpSiJKvNSrdCVHM
                                        MD5:FEF4DC5A79A6117235D7ED374987A212
                                        SHA1:690D30967A468B399320549E7D04F47E2E7F2E52
                                        SHA-256:D5CBF092012C0710EA36A3A1C51072DABF7714AECE783A6D8B010396427E879C
                                        SHA-512:07C5F904D0C2AEE27337753B4F038CCEFAEA5DED66D3C84B7352BEC6408D3D128A8BF1C5F0B3E9E72832CEFF5D5A395261F1E86C04160BAB99558E679E2D6972
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.wd......tIME......6..F....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>...........h2..t.<../......mB...f....6+.J.D...0...&..s..N...._..B..s....&..>~.?...c{v..j%.....)...#D..E...F.I...G..........R.S.C...$EL..!..GD.NP)~..t.=;..w.me.B.z.s...S......M,4.R.m.. 1.z..!(..hnE.6.Uj.cO..6.y7..Y.~fK..1l..WM....*..+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q...MF.{.7...2.m..0?..:..vux.....r..n.0s....Os.....Wr...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.blc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.....9........... {...\..B0..]....(eQ....G......jl....*..,)....C......r)BhP.../0...r.H(..0..,@.%6.....q.p-..Z.^IA.:......ur....%U|..)I...!4..ig.37.1...........E:..q7.......n..05A...uP..y..8.Pj....K.9.[...E.Z............L...u.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_cc0000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.702209367432273
                                        Encrypted:false
                                        SSDEEP:96:NsHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:6Hm231Nvu+wIqltWOe3nIH
                                        MD5:2077B5EAB79CBBC34DC270E93BF36BBC
                                        SHA1:296E7BC1A8528A7BFCEF17B4CD727D80285DEE50
                                        SHA-256:B54DCE3082F3377765C041F959A72007702AB54457DA21A20DFB15BAF9740954
                                        SHA-512:270AFFA25147BAE0713566E37D4B477C486DC77F4BFB8A239889BF3F31C073A402145345DDB8186D415838735852CC6F11567EA22F3497E496B1A903693F1774
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME......6..F....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.9034761541412495
                                        Encrypted:false
                                        SSDEEP:192:Sj0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxhi:SIgz9tEOJ4bKAPmZvqAbi
                                        MD5:A90930462F29CF706358262D88F1B626
                                        SHA1:C8B7178EB17C36A1DF4CA5BADF2A85834436FE9F
                                        SHA-256:F93D2A7069B40745FD01E364ED57771BECFEBD8868BB9130220A47E0ABFF9C49
                                        SHA-512:94775B3EC8843A93AB54E663E4E06728D6C2FD1E792802D8C5CCBDFFF96673F5B993039E1C65D178247CA2F21326F8D455B81425249663B54A1AAE59A423CA35
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME......6..F...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2515)
                                        Category:dropped
                                        Size (bytes):37326
                                        Entropy (8bit):5.311560606113339
                                        Encrypted:false
                                        SSDEEP:192:10OW0dCbMiEt7b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHz:pCwiEt7b/+vaW1e07PPiF5fy/EzDS25A
                                        MD5:6FD5A6E8197041971D02CF62D06F4B14
                                        SHA1:9997BEC65F4FFFD3CA7178E14F67B8CD6AD1A9C7
                                        SHA-256:A7AC54F58BA507B13621CEB6FCF5FE879F5AC9BDCF049D16153110C6AD048C7C
                                        SHA-512:BABA481707CB23D6432FCD6CE9E26380117B2E91BE44E5E3A75A0DC138F8812942C34D0A895D6B581ADFB33577B9FE6BFAFEB6D5FB00C2ABF2D7044979E593FC
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_25

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29137)
                                        Category:dropped
                                        Size (bytes):32076
                                        Entropy (8bit):5.255171404355352
                                        Encrypted:false
                                        SSDEEP:384:pCwiEt7lcR8lOXHc11evBMzymUh+4C6G/zDcSc7nfZBhVi:slEtiXHcEBMznURC6G/zD8BhA
                                        MD5:0B5729A931D113BE34B6FAC13BCF5B29
                                        SHA1:88BA90D2D2944315AFD28A706EE5715ED980C634
                                        SHA-256:AC1C8F94750B39B12327A5D0C56FDF946DABFB6D91E5D2A202879FF9A5D67E29
                                        SHA-512:68E1B473A9CF3731A4FB9CE3C3225AA1152009D3AB7D20E198C203DAEE3E388B25AF41A3A4B2A8ED79B4028DF19A93384FC026228B9192AC23D67ADD56C2CA11
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_25

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.structure.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):18705
                                        Entropy (8bit):5.342686576013018
                                        Encrypted:false
                                        SSDEEP:192:XW6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHL:XW/+vaW1e07D
                                        MD5:B75D9919DED1B610C51A4727DD4B9720
                                        SHA1:3C2C0061EEAFC1D3C0D8663481BEE315D38C5A5D
                                        SHA-256:135BAA57E778D769DB488FA8A8330842C4D2B6D3FE152EC1C7073B99075060EA
                                        SHA-512:72A4961E118A4D30F6BC7CB700520EEC3520C7BB680C9DE15CF9C9744E02ED81B34DE8E7B58F62675C5BEC6AB24F1CA1CC95AC10AF09A620335B6F4566AB04DD
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. */./* Layout helpers.----------------------------------*/..ui-helper-hidden {..display: none;.}..ui-helper-hidden-accessible {..border: 0;..clip: rect(0 0 0 0);..height: 1px;..margin: -1px;..overflow: hidden;..padding: 0;..position: absolute;..width: 1px;.}..ui-helper-reset {..margin: 0;..padding: 0;..border: 0;..outline: 0;..line-height: 1.3;..text-decoration: none;..font-size: 100%;..list-style: none;.}..ui-helper-clearfix:before,..ui-helper-clearfix:after {..content: "";..display: table;..border-collapse: collapse;.}..ui-helper-clearfix:after {..clear: both;.}..ui-helper-zfix {..width: 100%;..height: 100%;..top: 0;..left: 0;..position: absolute;..opacity: 0;..filter:Alpha(Opacity=0); /* support: IE8 */.}...ui-front {..z-index: 100;.}.../* Interaction Cues.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.structure.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (15418)
                                        Category:dropped
                                        Size (bytes):15548
                                        Entropy (8bit):5.293143563287801
                                        Encrypted:false
                                        SSDEEP:192:ti4ncR8lOG1bRCNPbtqxlhIuxrjv572hk/k52bZuQEjQDMsrsUR9P:tlcR8lOXHc11evs
                                        MD5:5581D20AA5062ED5C0B6048F68E76055
                                        SHA1:CF0560924A39F484D334498D5811836E4EC28E28
                                        SHA-256:AF16A2B37EDA9CA527A4BE50CD262D7BE26722C9A41A62C6F9984A4A4664C153
                                        SHA-512:A0CDB860EB208F5C820C7C16F3DE59B4AEF3A03420B1C9F09022D770F50DB13470A16D53D670C8BB0919ABF3BAA0B623A6ECF80DF103AF4D8F82EBBAF2BE3FDF
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed MIT */...ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:absolute;opacity:0;filter:Alpha(Opacity=0)}.ui-front{z-index:100}.ui-state-disabled{cursor:default!important;pointer-events:none}.ui-icon{display:inline-block;vertical-align:middle;margin-top:-.25em;position:relative;text-indent:-99999px;overflow:hidden;background-repeat:no-repeat}.ui-widget-icon-block{left:50%;margin-left:-8px;display:block}.ui-widget-overlay{position:fixed;top

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2516)
                                        Category:dropped
                                        Size (bytes):18671
                                        Entropy (8bit):5.157579434617568
                                        Encrypted:false
                                        SSDEEP:192:X3CbMiEtzlPiF5fy/Ec4dDAwQ2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhp:X3CwiEtpPiF5fy/EzDS25A
                                        MD5:C4679DB4ADB3F9B8089213C6C396E2EE
                                        SHA1:BD9C7C141312CE373116F98B120594408C1A6707
                                        SHA-256:984303DF44D383EBC81065261C781C8123A09B41417CB8A9C90F7B26BD134C7F
                                        SHA-512:29DC56431FBBABA567F72FEF2A525ADC6CACAC64DCB3C3B7480BD5546869536881FCBBE5AD959EFBA6E5F7E04CD1E109548FDD52572C90CE6361BCFB6F984630
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_256x240.png%22)&iconsError=url(%22images%2Fui-icons_cc0000_256x240.png%22)&iconsDefault=url(%22images%2Fui-icons_777777_

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.theme.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (13719)
                                        Category:dropped
                                        Size (bytes):13849
                                        Entropy (8bit):4.869966761350074
                                        Encrypted:false
                                        SSDEEP:192:tgGIzlzymUh+4pQz6G3PRBGWLiXxBm9v5B6xBpYPzFhCNBjVs5y6sybYw9QoFYx4:trMzymUh+4C6G/zDcSc7nfZBhVi
                                        MD5:C12CAC44216CF877FD0C6903F3794407
                                        SHA1:A3640158B618410B280A5F37E54661A8337D6BD0
                                        SHA-256:023CA8C9A46D9C6553CB0287FC8B31C6EE4F5C8D2CE02704D01CCF017F373E97
                                        SHA-512:F61ED746551E53070751FF5B3625924CEF68BCE58510BC5395588FF34D5EE416F0349E62AFDB9AE8BDB4B44AE8599766F8714101604BC76A87E25E101C7951CA
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed MIT */...ui-widget{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget .ui-widget{font-size:1em}.ui-widget input,.ui-widget select,.ui-widget textarea,.ui-widget button{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget.ui-widget-content{border:1px solid #c5c5c5}.ui-widget-content{border:1px solid #ddd;background:#fff;color:#333}.ui-widget-content a{color:#333}.ui-widget-header{border:1px solid #ddd;background:#e9e9e9;color:#333;font-weight:bold}.ui-widget-header a{color:#333}.ui-state-default,.ui-widget-content .ui-state-default,.ui-widget-header .ui-state-default,.ui-button,html .ui-button.ui-state-disabled:hover,html .ui-button.ui-state-disabled:active{border:1px solid #c5c5c5;background:#f6f6f6;font-weight:normal;color:#454545}.ui-state-default a,.ui-state-default a:link,.ui-state-default a:visited,a.ui-button,a:link.ui-button,a:visited.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_444444_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.920105159011246
                                        Encrypted:false
                                        SSDEEP:192:G0qa5wogj5iPmijz0onp6MYOF6zv/pw5a6a6kIBOo:ea5U5yHp6XqCvB96aqOo
                                        MD5:23B19953D6FF01805EBAC2A86924837B
                                        SHA1:CE3119A5D6AF1B50FF8D750DB706B6A3D5628796
                                        SHA-256:EB8DFEB98C17CA86564BC8B629D33DB66BFCB9D70B92E0718BEBFA9341E75607
                                        SHA-512:FD8772D61727CF266E18457F3C70499834EF9B0FB6C68A53762593827D72CAFD9D208741B6BF5C2CB9F8F6E97083B85BF9F81B339B8CBCA8BC251CE3DC335F69
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.D.<......tIME.....%...'E....IDATx..k.%Gu..m;....!.^.....l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S....d.5..x..^.../.2........,..+M..^....O..r..`.:..S.|.{.Y...`...`k?..a...6...1...@..5..S.#.Gd......).q.vX.u.B@.*.J@`H.N...A....1n.:.P..,D:A..q+.=...f.]S..q.!.....+Lm.>|...XhN.^.4.A...3C...J.....`Z.U.=.s.4.....)...-...`F8.i.RY..CP.....C.Z..:...{....p......@........px.h8..4.^...o...;..o2....Y..1m.=...v......E.GJH....i..U.g.>.k.6..R_.}.S..k..=..~5<.e..........n.oF......d{...U.^@...>]..L..-oz.....e..%PE.dR...=.I.l.O\r..6`.S..`...dxup....../........@........px.h8..t.....W.....9........... {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.`

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_555555_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7074
                                        Entropy (8bit):7.928410973506381
                                        Encrypted:false
                                        SSDEEP:96:HbTMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6Ka3:8XTvYXQzy51nfmcuXibSralG/a3
                                        MD5:EEBB826ECD3EBE8C61B5EE9645879A2B
                                        SHA1:78B80151260D9A2722BE8D5C17AEB27EFF194C58
                                        SHA-256:A19D489F7769610F4AE20BBA35E81041BADADB8BC443D256D33EACECE74E909A
                                        SHA-512:DA08F4C488ED432661493233D3CA07E015EE39566CFE80360CC94B5EFCF1F28559BC2CB622466948DEC6E6A22ABBBE67EDEC7450FC24AC311CD19003675F44E1
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.U...I....tIME.....%...'E....IDATx..{.$G}.?m;....!.>...l.....G$,..&.%.|.........].]..=...?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W.^<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_777620_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.766757991708586
                                        Encrypted:false
                                        SSDEEP:96:7NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:rHm231Nvu+wIqltWOe3nIP
                                        MD5:0F7BB232F0077013CFE3231B6D56F201
                                        SHA1:07183152ECF40C6F277B3DDD3A841C4F9F046611
                                        SHA-256:FE1AF6959B854C63CF101E6F51B8F15296A66A287FDF4B1283A3AF199D2294F7
                                        SHA-512:B29F864170DB2C7B21E2530D16C76757045A91173CFB8F1A99CCD214D2625F74C986D10A98A339B8E81D65757362876A9060EE9D3C2FAD994B8F61783866A615
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEwv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv .......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_777777_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.919277243804909
                                        Encrypted:false
                                        SSDEEP:192:+ZL/Hq8z/FyEJ3kJpSiztKi4NkaerdCVHMl:y/HqpEJ3KpSiJKvNSrdCVHM
                                        MD5:EE545339F50EAF87C6AC783B2C8D17E8
                                        SHA1:FD1AEC501E23B0A7A022DE638234C15316AA7D70
                                        SHA-256:04E0C4263C2829DC10E9E1E39E9D186F60775B7BBE5B15BCC0B33BE5B0E575EA
                                        SHA-512:BD889EA0D6EABB217C019D78A362B29D2575BFDDE5C4A403182052B9E198F59AA36091BD8267A474864717C01D0203225C6D29C1AB3CF086A87B93E40128A3EB
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.wd......tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>...........h2..t.<../......mB...f....6+.J.D...0...&..s..N...._..B..s....&..>~.?...c{v..j%.....)...#D..E...F.I...G..........R.S.C...$EL..!..GD.NP)~..t.=;..w.me.B.z.s...S......M,4.R.m.. 1.z..!(..hnE.6.Uj.cO..6.y7..Y.~fK..1l..WM....*..+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q...MF.{.7...2.m..0?..:..vux.....r..n.0s....Os.....Wr...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.blc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.....9........... {...\..B0..]....(eQ....G......jl....*..,)....C......r)BhP.../0...r.H(..0..,@.%6.....q.p-..Z.^IA.:......ur....%U|..)I...!4..ig.37.1...........E:..q7.......n..05A...uP..y..8.Pj....K.9.[...E.Z............L...u.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_cc0000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.702553996522658
                                        Encrypted:false
                                        SSDEEP:96:NNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:dHm231Nvu+wIqltWOe3nIP
                                        MD5:43C9C3B95C08C992741D28AF12E36597
                                        SHA1:0F8640441757AC39626E42E6072B5E054F3523D9
                                        SHA-256:679FD5C7A9307B11B44F72140129D489B2CDA77C9001CCAE7FE7C564534FBA5B
                                        SHA-512:2D0BA16FAF9239D809E3C05C5561CA7F838CC013FB71357D83A1BC321B97D8DFF4F7F722E051767DD8336ABDE86DEF3BF569FE69FF485EDC959104F8F69080DC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):35973
                                        Entropy (8bit):5.266740217260602
                                        Encrypted:false
                                        SSDEEP:192:10OW02ANbMb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHllPb:xMb/+vaW1e07/PiF5fy/EzDS25qb
                                        MD5:C4A88EC0CB998929A670C0C58D7DC526
                                        SHA1:03135A88E8DBC36020DD453D1E7407CE9A3A2CC2
                                        SHA-256:44F8A56D427917B5FA0DD7933BA545679BE5E6B3B93099E64A4E29C2159F57C0
                                        SHA-512:FD0D6C06ABCD661796DB2BC071C2A2BBFC5CFE8D80B434B68CD068CC312A03FF0C93F21C1FCE77C2BC03486A80765EE317239639C79F2EDC03777918A36EFA1F
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActiv

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29135)
                                        Category:dropped
                                        Size (bytes):30724
                                        Entropy (8bit):5.207927153668432
                                        Encrypted:false
                                        SSDEEP:384:xMlcR8lOXHc11evBMzymUh+4C6G/zDcSc7nfZBhVtQ:xHXHcEBMznURC6G/zD8BhY
                                        MD5:8DCEBF12FBABEA677390CFA6D9AD09FB
                                        SHA1:3765BA197944D25B3AEFE663300F0C74A6EEE792
                                        SHA-256:B0419FAF03242236E04C1C062D52B7F011BF5F0222342FC4006F51CEC7DD6BA0
                                        SHA-512:A24138A305C3D247D7CE05570730832224929695E7DED25B36876782C4E72183C95A3B9886D27EA8CA1CD3E594C0B1DE3B09ECD309B9ECA6BDD3716A40A335B0
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActiv

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1166)
                                        Category:dropped
                                        Size (bytes):17319
                                        Entropy (8bit):5.050806478020723
                                        Encrypted:false
                                        SSDEEP:192:XcANb8lPiF5fy/Ec4dDAwQ2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhBb:XLCPiF5fy/EzDS25qb
                                        MD5:829DF24BE21885E09FA3E76156B47087
                                        SHA1:285600EDCD4B0CAFA3C82FC9C9A32310B7483B91
                                        SHA-256:6DE4F2D1B262787509F1D31EC58C9DE526A12833E0D10B6C2DD085F69AAFEC72
                                        SHA-512:0F3999088E42FB1F83F1AE4C037B25EF407A6FC078DFAC71C0B5F0B0A2CDF2BA97C6C0C3ABE92D73B3D26AFDC4A5AD95979A0E06E92C093CF1E8967685D7EDD2
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActive=003eff&fcActive=ffffff&iconColorActive=ffffff&bgColorHighlight=fffa90&bgTextureHighlight=flat&borderColorHighlight=d

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_diagonals-thick_8_333333_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):383
                                        Entropy (8bit):6.418386094265965
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkp4/ZGwZaar2s3pMcXRs0w8UvFkfxxzgN+E8VLEMlVbEbp:6v/7MCUUGhLSJQIZxzS+EELEMPS
                                        MD5:F9116832CBDC3F3EEE2DF7EB0F6A53B2
                                        SHA1:BDD7D30174D4AD3A2C2DE75293514C5B799AE7F8
                                        SHA-256:E118AF3DA06F5EF3A6AF384E50F1A84C63C7B4F4186E5F81D939DA5792FCF19F
                                        SHA-512:45C8553BD148FF24CBD55AAECD4D053D73B334AFC58EF3E7FAEA54B00095352E3DAA23ADFED7CA68D4465159CF2D9F676E361AAAD958E974587F12B61EB68A51
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATH...1..0...g\z.."^.{.J]..Rj)".......h.[.S5%kH.5....\.)...'..I.v.\.(.W.....{.....@.. .I.r....c.....M6...c..$...\t...N.N.N.6....N..r_...5.j...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_glass_40_111111_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):5.943230772078117
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/dM5auUVA6qhElyrn9e0xzgN+E8VLEMlVbEbp:6v/7JSU4M5DUQMyrn9XzS+EELEMPS
                                        MD5:D13BE7DB4996BEE314A57491201C8B58
                                        SHA1:4AFC6DE24265229B1CFA27C0DD3984C53F51C69C
                                        SHA-256:BAF8E63100F2F3FD4943853828A6E7D63516FFEDF475F91C6DE10FBF59306D7F
                                        SHA-512:D359FE3EB8DAF1E2F03E81355FA812C945512D0D681A49CF92990928F36756FBEED324C1D6BE1AFE5E841778D0C467E88A1957F4B074AF61643B185465E97189
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c0.ab`.E....AP.Ah"...&..L,.L...X.0..3..0.<`b...Z..........0...EC.......ko,R...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_glass_55_1c1c1c_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):5.998240864963048
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/dknvmNpO+i5sjLuQzgN+E8VLEMlVbEbp:6v/7JSU4kvmNU1GpzS+EELEMPS
                                        MD5:F7F7F2042EC068FB769B614ABC136089
                                        SHA1:8AD56700FB8DC32FCABD4604128C9C29814CA17B
                                        SHA-256:EA8CAA1338B99BBA1AD99BAF12910FC9659CE3CD717BB7A756F395F8CE1186AF
                                        SHA-512:145D31F2CEF8B1A9051A7B19E5666D83148866068AF6EB6268F7F1C9CE81F8EB741B719FB39B344FD17C5CD8C3129664925AE85D94A309512B71400D8D755C1F
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c.gb`.E....AF...;.K...+..K..fLl)L.....1..0..0.=eb.db.ab...X7...EC........X....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-hard_100_f9f9f9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):315
                                        Entropy (8bit):6.069460361707883
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/+rMiManu6qbNb1Z5/0xzgN+E8VLEMlVbEbp:6v/7WdULx/u6qBRHgzS+EELEMPS
                                        MD5:DD8011FFC4BE430E76DDA8C3DF420FA7
                                        SHA1:2635A9A6806D0CE478500624EAEAC4A0CB3638CD
                                        SHA-256:7275896D796C6A96FC4CFB741BAAAB19A2A9062923879CE19BA13A85D07575B2
                                        SHA-512:964C87BECB4621A647DA780A4EAD464D94E61DA9451C9F4DF755C04A17EA9D9265D3BD090F0ECA8AA3DE5662707FDF236E7F990275D9D4174BBA1A688891DA83
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......CIDAT......0.@.....].)P.b.H.;....%a.&7...<!..W..~.F..%UN"...'........|....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-hard_40_aaaaaa_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):316
                                        Entropy (8bit):5.953737371641402
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/KjtXL85/j6czgN+E8VLEMlVbEbp:6v/7WdU185/5zS+EELEMPS
                                        MD5:3B10BAFB1BFEBC8958BFAF5AA18372D7
                                        SHA1:D77817917C1C2F2002AB60481B07CD3A004B19BE
                                        SHA-256:E3E1813A7CF5A6DE95E8E11FFB960C7EDEFD7FAAD9231C82B614A33A4C7E843F
                                        SHA-512:24BFB8E3E0AB53A31F05B54C8A7FB37F814D944C3AE234BC02A252CC152ACBE529336FCA138D3755F0B57EB7F11A6C0190B61C4F98CB2480619FB69645300375
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......DIDAT..c....0p....#..g...3.|......?E...L....;1.kg...........N.&......\N.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-soft_50_aaaaaa_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):327
                                        Entropy (8bit):6.091868777218178
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/Kd+/G6VUUPTSW0xzgN+E8VLEMlVbEbp:6v/7WdUjd++QPTvIzS+EELEMPS
                                        MD5:A7C11E299800DCDB2F55A13F45B918F7
                                        SHA1:37A870A99EDDCBDF6AFDA87CAD35FF859DA5ACE3
                                        SHA-256:504BBD359106983B5F2308454EFF131488AA8D7045024404D38B5B33DF35731A
                                        SHA-512:9086DE10BC06FBB4B39005A4701A344BFAB32868CAFD5595AE96DC5C79F3F4C79369DA91D12CEB44BFC0D5C9113491F0163176A22967BEB4C1259112A01EF2D7
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......OIDAT......@..v".......z^".xJ.o.....3.... u..g\.q......^9Gr.c .+.6Z........$Wq......%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_inset-hard_45_cd0a0a_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):382
                                        Entropy (8bit):6.324898529211006
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/YWBCKcBEtB4TxlkYyoLmV0mpmI2zgN+E8VLEMlVbEbp:6v/7WogU9+zW0KrmxlC09xJzS+EELEM6
                                        MD5:0C015DD5EA07876869017B31E20A21CA
                                        SHA1:E7AD3FD785801B29871B26B93C815B0823A21217
                                        SHA-256:6BF056456FF1EC2AAA9E7EC59C12EE6C27BBFC1815040AFBB71F676510EB9EFC
                                        SHA-512:9E538918F1B270233B0FCA3237202FED8DBC057007F8DE14494D531D36EDE0E992F79C17623DF172057441671AB9F8E4BF2DBC839115FA9D8E0BF29F12082F70
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.c8{...........a.".b8..}........,/.._.a.acb..r.....:...%...TDUD..m......D.D...X....*ab.`5e5eb..z..8.#...>.>.L...............O...I...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_inset-hard_55_ffeb80_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):367
                                        Entropy (8bit):6.3091011246601845
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/mi30kxY5/Us8hspVXE7zMr2zgN+E8VLEMlVbEbp:6v/7WogU9+OS5csQsYgKzS+EELEMPS
                                        MD5:CA9994B73AE1D814651B5C432454C125
                                        SHA1:960844631D6DD1945B037F7A1C34BA4BF4FC069F
                                        SHA-256:7EFE027B1718E3D144748C0536C3F2F51EFBDCE091947D3130B1E1D758D79945
                                        SHA-512:599891DA64A297AB12F061E30FCBAD13BE729C7647A58AE6850CCD4050169ADE5DE1F964A79F97209BDF41C5E0C5E1A36A409166716430FAA27752E78D0F683C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......sIDAT(.....0.D...-Q.Af`..T..=....D...sd.....S...B..t.Qk))..v~.N......h.....L.&...e...n.Z?.3.l......^......oV.....i/....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_4ca300_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.750560950350824
                                        Encrypted:false
                                        SSDEEP:96:UNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:+Hm231Nvu+wIqltWOe3nIP
                                        MD5:9D55E0E837EE95E3E837DC2E0DE0F7C8
                                        SHA1:95EA22082368AA0BBEEE4597E7FCBEC6C4CC881F
                                        SHA-256:457C38A99605DAF10195C3A8C87C06318FA0FF040B75A600A8D54604490BA97A
                                        SHA-512:F903837E8FCAD110872114B9E3C1C16C6FABAB31CFAFD1C602FC2B0CF8CADCC99AC2DD9C7AD25D18153D391632CAE8BC508901FA2E510A85D8C250A796F27852
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEL..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L...<.k...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_bbbbbb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7092
                                        Entropy (8bit):7.923076697213992
                                        Encrypted:false
                                        SSDEEP:96:+bdL0XdnQW8FLZ3Iz6QlfUGxGO7TjLZxkSR5jsUeuOkjFWr4n2Otk54c+tEBNrDb:ykSFt+7/xpT3Zua5gewr4smcZrDaIx
                                        MD5:947F1A81E0EEECAD8A78B92B269E3C2F
                                        SHA1:4ADACD01B707EAF141426B565937D0651EE0F808
                                        SHA-256:748E923944BED881A8384BD8F6A90D83BA56C30B3FDA34E77A3A2EB3381518F1
                                        SHA-512:41C5907FA5532A13490E462CB9D5218FF06CC8B0C40DD29FCFD4BA55FAC3225D0B13A55900A3CD77B6ED36996A003D52C63A90622AEF6DB6353009892A6BE1B2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...>I6....tIME.....%...'E....IDATx..{.eE}.?.H(bX.1..[P.`....J.H..Ef..M.b...F....,.3...`V.;..!.]..E.<.K.@U.#"..-.gWEBL"8+qW..q.#E,9......9..w....{..u.........u.(.M.i..G....... .EH...Hx...2..$........+.\.....8..................FOoi...3.Z...W".0.<D}DV.....B.7n..Q'.....+.....q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3`.J...[.....Z...S0.Ms..}`.....T(/.f.}......<..)...]D..`....0.../..._.l8..4.^.../........@................=..E.M..2....`gO.{..:\.}....=....\.z...\..mc.-...>....(....W..P&}..n..b.`.....f.Q...P@..P].Xq...a.............jmP.I..U.A&..........%..`.._9u.......W.7.~!.....px.h8..4.^.../.......~g`...q...Zi...Q/zO*..9..9......C..! .....?@X.R.U.a.`}`L...Uc...%T...I.l.......8T.K.B...%...&..{FL....f..-.....g.....u..t.....H.(Z'.a.;PR.OW=%n^.<...9.t.f..e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..f..c/.<...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ededed_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7011
                                        Entropy (8bit):7.932572114070276
                                        Encrypted:false
                                        SSDEEP:96:1bBnMc0k8bUamXEHXe/FOIg7O/8zKLnH+48ZJsihJm14JQZOZ0l0z3QODetQ3KxF:4dnmU3QOIuEH8s4JmYQZVCNStQ3KZZ
                                        MD5:65A3748BAB77F6483133EC328B188064
                                        SHA1:F57C6E88D41BD50674D2D017EF9AF010046A9F07
                                        SHA-256:86069EA4DC6EC1F1E7BEB42F4D2FB463FCE56BB5EBB0E9EB35AF805CA437A995
                                        SHA-512:64CB897C58F276E07F5F10FF399F48B720C8AFB5202C823DD64180B1BEE7D6460B6D32826D3315457A38085DB656C077648EB81432F3B9D3E2E7C0D7A26745D6
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..t6......tIME.....%...'E...FIDATx..m...y..c.Z.....c.......BR)....6.bz.H...I.i.z.w.......P.-...z.6MR,...U.X.b;).n..XCc..8.*.......63..{..W..w.s.9...9.s...7.u.^W...p..9..D4.i...K.G.4...su.@......._:........{....H.}....:...u~?<{S..t.H.. P.|H.]...G....p[.....}X.U..<0...)..5...x. ...>P..\.......e....W..m.k\FHz.}.h..=h.>...T./......%W.g..^.@.]....F-{.K........dS?..P..z.=o.&s.......{...D.....dn..k.#@..f.k.G......p..9..j.G......p.........?..G.........`VO....9<..@...?...L.j.mS|.-.~S.s.Ou............R..mj.)..?..v......eG.....@.].U/ Oc.?m..t..]......E.,P...3...?..\..'.rg....S....._b8sp..&.j.G......p..9..j.G......8....;.=..>WZ...U..F.e.|c....9{p.......o.../!)...0.?P..-.L.....&U..+.....,.@..h .K.5....y...Y.......+...7...M,.?=..^..[..H^.:x_k.4..Uj..=.4}v.Y..K]._#..\..6H........cJe..r...r=..u..).l..nA...m...y.L.8.Tr...43X_.....Mw...6..ea..Y..H.`.uV{..,{.n...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ffcf29_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767851566820116
                                        Encrypted:false
                                        SSDEEP:96:WNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:oHm231Nvu+wIqltWOe3nIP
                                        MD5:E03E6956FA5640722F7BFBF9F22760E5
                                        SHA1:E18833F077DE41C9A359BFDB7E7DF79131DBA564
                                        SHA-256:1A5FE2498D6C5FBB906E0A68C0A48BF08DC144A7CDEBB983B6F17CB35198B9BF
                                        SHA-512:F258995BB5DB6C920819093DE011B79201B6AEE90B57E20E1F781393E0FD4B5A1F26CFC6BB623F070B524E1C384A56CCAE932A984F650E07A66F8CCE62252771
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)A......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36674
                                        Entropy (8bit):5.276783694401348
                                        Encrypted:false
                                        SSDEEP:192:10OW0SvuQb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHVVoEa:evuQb/+vaW1e07asF5fyzE+DS25Plak
                                        MD5:BEED825A76BBA558B11EE1D2683BE1F9
                                        SHA1:5B3865CC0ADBB0CF8E54AD63687BB5B8D84878E6
                                        SHA-256:1A81C06B3EAB67DBD6225F0DA9C691D52C3E9212A4D56CC078C75E816DF65160
                                        SHA-512:9AA268EC3CC7C85007B45A26700BD0DF0B84800843DFB8A5BD752500932D407EEBD4EBFCAFB6BBDB4C24E438A2FAC0CA045D75DFD455DC1A8AA1B757C67747A4
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderC

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29598)
                                        Category:dropped
                                        Size (bytes):31403
                                        Entropy (8bit):5.218906180606099
                                        Encrypted:false
                                        SSDEEP:384:evuQlcR8lOXHc11evhdaizkmm+4e6GpbPJSc7nfZBhVwWGc:e2LXHcEhEiz1+e6GpbP3Bh3
                                        MD5:1A7F4CBB81865BDE3C2688094010597D
                                        SHA1:FAD0EA59849100A277AB699429B6ED863C50DC01
                                        SHA-256:332BB17ECBC7843D708B19820FE827737CDF11059F28413111B86004382C69B3
                                        SHA-512:D38AFB63C3784E1ED527EA86FB868154857C01090FECC262E792032387464D8D343E3BF03B811AEE0CFE7F95A1B496AC72053E7BD5F547EA61932570655A5899
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderC

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1382)
                                        Category:dropped
                                        Size (bytes):18020
                                        Entropy (8bit):5.077568249061877
                                        Encrypted:false
                                        SSDEEP:192:XsvusVoEH6u5F5fyA7F4EcItpog2rgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhKPT:Xsvu/sF5fyzE+DS25Plak
                                        MD5:306C70C02BB94F2FE6365BEB055BE475
                                        SHA1:2C44EA8724D921ED0727013AFFF16FB9A2B14B27
                                        SHA-256:598AC7113B48B1FB114DE7DBCA0345A46623EC632238FAD2F32F46DCB5FD5374
                                        SHA-512:31049FA51EAB36D6E7E5F806D1E59DB021CA3453CD3FD5E64AB05276F1CFE4B9356979DE6BDAB7FBCB8132F8C76F77E437624C044BFB3C08188DA4924B7A8632
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderColorHover=000000&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=ffffff&bgTextureActive=flat&bgImgOpacityActive=65&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_diagonals-thick_75_f3d8d8_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):471
                                        Entropy (8bit):6.7049806814793484
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+KOp7UknnhJJCKHh/lzS+E3V+2EMiVw9:X9+5p7UknBRBNzjE82EMr
                                        MD5:B58EEB6905F1DAE619D559C85401D8B0
                                        SHA1:CFEFCE2277F8EAA63F8C9B05DBCE40A2004D2335
                                        SHA-256:35E18EE04B19399AD8F10DCFA7C87CC34A651C86BE4FC8FE1FB436945A222FFD
                                        SHA-512:132277DC65EE61A38D67F8AA92ADE513DA9407AB90542D29645CCC317F45CEE10B0616FF443F2D45878B3A59E00A480733F84B0E9C35ABC75677AB9A5C4A6C03
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATh.....0..a@.f(.J..2..7.F4HiR..K..t..U........m(..:.s...?.....N~.E0........U2^W.!x.J&.]..*..r7...&0.Z..E0........5..P#..Uz..-R.V..R.`.T..Am....0.Z.S..0...=P%}..R..E.6.I...G-.....MM.......~.}.S.`.T..A.............%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_dots-small_65_a6a6a6_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):266
                                        Entropy (8bit):5.610835048236541
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPg2pUyKOkHkNtF6oXmj2zgN+E3VKF2EMiVAVTp:6v/7I2pUb9j2zS+E3V+2EMiVw9
                                        MD5:514220F4C236074C7FAED6FE1C61D0F2
                                        SHA1:47FC23159EBD07EFD56CED673588FDEBFC93A411
                                        SHA-256:9118A1D5AFCD3E5295F40A64E8055E751E0F1BF60CE75BC6D62945EDE01AFA2C
                                        SHA-512:1220D03411CF36FD1943848EDF867A8CD0FCB664CA939DB447C3A9490369C85B7D6DE8E6EEE10D4F1DFA03BF30B3B739A5BD17108A6F2F3A3958F1313570ED51
                                        Malicious:false
                                        Preview:.PNG........IHDR..............M......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDAT..c\......AV.......l.n...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_glass_55_fbf8ee_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):398
                                        Entropy (8bit):6.489244714170791
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+d5IpGI9vAvTMbubI2zS+E3V+2EMiVw9:krr9+TIpxWTMbudzjE82EMr
                                        MD5:D93B9B26FC8C0C5959B707DA1E45E788
                                        SHA1:813E0CE3C904F5702A8FA7975D5064347DF601EA
                                        SHA-256:DD54BDDEF4B35E2C3F7AACE9527EA022E6D0CC02A54178F4526045EB4C947900
                                        SHA-512:06064F68BC510447E9960469D9AA90D6F08B547184DA0DC98277C0D265CC429D85270600B6F9D8F5496384B8CE54A0D1E25318D40E0748480A794C5E59B811E7
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....@.....)D...6....u..%,...i.@&...M,\ B.I..p...U_....ln....(......I7z.B.\...,,q."X...%3Wae...G85N.d..6...a.^.bp..wB.....GAH..EZQ..|.pz(/.*.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-hard_100_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):316
                                        Entropy (8bit):6.004377221346415
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkNQFicpa4b+Npj2zgN+E3VKF2EMiVAVTp:6v/7WdUkF6c+NpyzS+E3V+2EMiVw9
                                        MD5:15685D4DCE0B8FFF8B3810B016383823
                                        SHA1:053F0D670552C5D15AB78A41A02974715D0A416C
                                        SHA-256:D06EC7B51177FDB1ABF190EBA73D582FD0985E50E769AF19F9446D5D70CEDC55
                                        SHA-512:57E111F28AC6F71CC460D290464F9216E2298A25DFF7E20E7B60DBD24F7FEFEEE99131D1A6ACF47182831A6557FEBE719288849EB782418FE0D1EA5233E498CB
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......DIDAT..c.....0p.=...?$...0.7b...._.......O.L....;3.?......u'......u...y.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-hard_100_f6f6f6_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):316
                                        Entropy (8bit):5.9763265231364215
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkNKgQiPkpP2zgN+E3VKF2EMiVAVTp:6v/7WdUj/Po2zS+E3V+2EMiVw9
                                        MD5:B9D37A48EBD94443F5C3E2822DD090D9
                                        SHA1:55100A616B47D71C9E438D9061438B2A706F7BFA
                                        SHA-256:2358CD25032A62FD31EC70B69DF51243019A7EFC155D8A1507B5411355F8417B
                                        SHA-512:FE43ED77F5D635F73761AFC40178B37C34D29B1CF0CAD29D55FBB6DA644C2E335F0D4DF5EAB6FF13D324E707FD01B8DB5C50B8726D95866F419F4B31CBAD9E2F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......DIDAT..c.....0p.;..%......0.f`....K...T..b.?.0..b.~..a).w).o....L.......k.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-soft_15_cc0000_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):385
                                        Entropy (8bit):6.424213165792157
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9++Mef7VkGTqOgzS+E3V+2EMiVw9:no19+7ef7TTyzjE82EMr
                                        MD5:14A6FE8CCD61F8625F5DB721CBC48424
                                        SHA1:DA6981BB8CE4F183C5954B9840C24F75A4E7A69D
                                        SHA-256:78C17A090E9CF7DC82BB4E51A760015E73734EC2DA03730EF585BA52A92C0EF8
                                        SHA-512:264750DD734D000458706FD32340B8EFF021FEDA7FE2F5E925C2F5009A1EA1EDCF2C47A515798BCA8F2003221210AFB2D1D5BDC1D6E72F4C8FFE96DE07FD7758
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..;..@.Dg..,l.....4...t.5.t......|)....T.....y=...$..>..V..h.D..D.EMm...w..LK"Y72.j.&.%..&.Hz\..X.8?.V._Pw.s..9T.2o...|..../.`..?.7...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_004276_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.74148520890888
                                        Encrypted:false
                                        SSDEEP:96:kNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:uHm231Nvu+wIqltWOe3nIP
                                        MD5:265053FC5F278803065C40324D689469
                                        SHA1:2AE551B825ABF8171B75BFC51D4F13447381FC3E
                                        SHA-256:4F6176A29AAA41A97A732AB8071DD9C12BBE85502EFADBFDB5814146DB5C7408
                                        SHA-512:2917C7518C6E4624BC0C3816B34135CDCAEB1833B129568BCE3A812364EB0E822B131F44F4921FD42F46452668DEE6442EF251DCEF1564505AAD33860937B685
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv..A4...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_cc0000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.702553996522658
                                        Encrypted:false
                                        SSDEEP:96:NNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:dHm231Nvu+wIqltWOe3nIP
                                        MD5:43C9C3B95C08C992741D28AF12E36597
                                        SHA1:0F8640441757AC39626E42E6072B5E054F3523D9
                                        SHA-256:679FD5C7A9307B11B44F72140129D489B2CDA77C9001CCAE7FE7C564534FBA5B
                                        SHA-512:2D0BA16FAF9239D809E3C05C5561CA7F838CC013FB71357D83A1BC321B97D8DFF4F7F722E051767DD8336ABDE86DEF3BF569FE69FF485EDC959104F8F69080DC
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36567
                                        Entropy (8bit):5.275179603321093
                                        Encrypted:false
                                        SSDEEP:192:10OW0zW61rCliJI5bZb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMEA:2Q3iZb/+vaW1e07CfF5fyyEpDS25mCM
                                        MD5:BDA6B84BD307940ECFBC26AD9C5F8D8B
                                        SHA1:0BE54254B17821EE818E3384C34DB140F01FBA8E
                                        SHA-256:0EACFB8B5C21F4E24DD4B641EC9D3A02A3AD5C22CE0ACBBDDE88049B62CE6558
                                        SHA-512:5CC2479EDE5824DE6EFD5FBFE8065D2D6FEF494701C49A6CDDC1FAB5B5B984A30F03AFA2AA7B1412933817E5F6C4839242B761458A733324B37276FEE0C9EB8C
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29518)
                                        Category:dropped
                                        Size (bytes):31305
                                        Entropy (8bit):5.217186999993763
                                        Encrypted:false
                                        SSDEEP:384:2Q3iZlcR8lOXHc11ev9/nz1mzn+4c6GX9NISc7nfZBhVb0u:XiwXHcE9/nzgvc6GX9NYBhn
                                        MD5:37CCFA3CD39F71C0D6F05D8F1F3BE4EF
                                        SHA1:FF286271B64BE28ECBAC62BAB9D2DAA815294737
                                        SHA-256:70687998314C27942EA241BBE9929C05ACAD1074DC1C93A24D7872C70A241319
                                        SHA-512:4AC26AFA617A491F8D4791A2CE05425110F7F5D2DF1D983630E244E5EA06523D299B731CCF4BB1A37EF4A42F372FBFA19EBC615E471978E712389AE3D2B50B68
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1364)
                                        Category:dropped
                                        Size (bytes):17913
                                        Entropy (8bit):5.0738958492108
                                        Encrypted:false
                                        SSDEEP:192:XJW61rCliJI5bEh2UO2VFF5fyVj5SvEc+1bqyQagmB0iBfT9RhS2wV53skuMaaS0:XIQ3iKfF5fyyEpDS25mCM
                                        MD5:B16AFD83FDE3A4441D2014186A13862D
                                        SHA1:BA5CE93C86044EA086F3D6FC40A01BD36801FB00
                                        SHA-256:A81FC809E067BE4F135446F6DBE947D2057DA16924E9680467167C7676D47FBD
                                        SHA-512:D5EBDD4E550BBEABEAF75513B5FDFEE2A9B80C1B440799B6B63825160F3920F1F929BAFA441A9A5AF76E2B998180A382B5780CFDEA983A56C997FD287AE1C289
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColorHover=cdd5da&fcHover=111111&iconColorHover=cc0000&bgColorActive=ffffff&bgTextureActive=flat&bgImgOpacityActive=65&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_diagonals-thick_90_eeeeee_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):6.468213795058188
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkZGjpHrlcFtgNxC7eGoEJByG2zgN+E3VKF2EMiVAVTp:6v/7MCUjGjpLlcFtsEyG52zS+E3V+2Ek
                                        MD5:254973041F2F3FF094034CF79E1DD669
                                        SHA1:4CC6098DDCD7ED82D12A426903597135E70BDF94
                                        SHA-256:87FB6CDDADBE598544359DB6A8C084C5576A82122C4877D6BCF235FC9E0304EA
                                        SHA-512:E55C11AD7D6790FC3B65D3539236FA099791B8974DA49BCD5BB265343A5EFBB4D5312C9CB3417AA66C876DD1A3BBD6BB9F7047D066CAB00C2A048F5CE8E4BAC1
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATH...1.. ...g&..9{...8v.."....7......C=.hI>.......)...'..I.V.....Z1.[6.s...&...Hq..8.XN2..|l..Oc...Sa,...!3..N.s.).).)..S~.)7x...[.T...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_100_e4f1fb_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):408
                                        Entropy (8bit):6.53300658338152
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+BX/ut8OWIlavzS+E3V+2EMiVw9:krr9+BpbIlKzjE82EMr
                                        MD5:CEC0B018D99CE30327D69D3C4FAACA11
                                        SHA1:8FF0F4BA794B38F968D84C037DA4640AC8284EEF
                                        SHA-256:DC094D8BFAC52D7F488851A2BBAF0C87D22FCE9B582357B012030F8CD9905F81
                                        SHA-512:3D8F0C7DA9203A946AAF9E211C29BAF053D13A5125A8DF7040A1A8008DB2F18C56C9AA705427769D572E2F7C05A5701FA7E1C313A05BB922BEC45A9F18690E85
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....`....y.$.Q..0..d.b0...z"...,.;.....a8..|......c..o...7^.jg.....(..m.e.4..a.=a......p..b..5S...Y...Xv...<.p......{B../..z...b.0a..`.>:.1.(..C.I./.b.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_50_3baae3_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.428194654529718
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+rX4uXpVsOiIENIzS+E3V+2EMiVw9:krr9+Mu5V6IENIzjE82EMr
                                        MD5:BB06E6A2F7440CA2A11050057FE7926D
                                        SHA1:8C66858D8FE1968DFC47EFF20071419BCE199A28
                                        SHA-256:297D55F5A34F5F3B6CE0E5E7452CA5657220E24B0A6579B833199C102E747E96
                                        SHA-512:FDF6D59296056B5D0D080D7245F782CC692D84A0C6843EF5F061BB7187942F68DC641D9C281A556CC6BF33C49F2F484956EE0A76A256CD644384ABFDC7727DD0
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.cH..{..&&......Qj...F.Q....e...Jdb.f\.h..R...P..r.i.c.....u..L.,L...!..&.t....Ll.L....X.211.db.c..8........LL.....L.....|....(5J.R.G..2.!TT......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_80_d7ebf9_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):404
                                        Entropy (8bit):6.478097767551162
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+0B80mmp1tqzS+E3V+2EMiVw9:krr9+0STzjE82EMr
                                        MD5:286B528907DFBC11DC44A4CC89681635
                                        SHA1:BB075DBA4E783299AC06F110BFD306687D8ACF7B
                                        SHA-256:E240FA34AA81B5D4C07650F52C4365E15477DE775F19D12F9B66068A909D1C75
                                        SHA-512:DE9F032CB8CCD1AECC56F27A1FA49B5126E9C26F776247551FB766A21EF2303CAE2845A3609F2D721ACA1553FE0AAED93748FA6B07CF65D0300E769B27E7EF77
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH...!........fs.jpc.5.4...l&...08N@2;<..71....A.H..N.......w.....0.o.4-.....N..8B.....3dN.k.......]..+<1....2..|^.Z..}unW.....&..k.E.}t."m...C>B3.N..L....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-hard_100_f2f5f7_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.505409455044373
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+BF1J67j9szS+E3V+2EMiVw9:no19+BPw7pszjE82EMr
                                        MD5:DC0A7DD2653B260113C92C1936198B21
                                        SHA1:D4B267AAFD2A80DD47F11448D0AFB31688573D05
                                        SHA-256:10A05D8BE2E8C53FF0BA522E023D6ADF89F5A613F2DA25DC8AC05EB727276853
                                        SHA-512:C9AFD3D5618BF84CF76E0D73F3764798219E35FB8BB25BEA22C91374C0FDFFE41D5AFBCBD7F9E8C550C1DC2A0FD28D9C5F2C93377A54261E9ED433A41AAA4F20
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....@...?...P..fAT!.q..Y.....A!....a.D..w..&0....>...f.5..?.h.H....,.g.">.F.....jm..J..?.#f......C....d:......k..v.S..4....O....C.,MK....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-hard_70_000000_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):310
                                        Entropy (8bit):5.946430929652425
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkomhhPhgTljzAiyG2zgN+E3VKF2EMiVAVTp:6v/7WdU/VqlzHyvzS+E3V+2EMiVw9
                                        MD5:3AD15B0B6700A003DABEB7052E80BE64
                                        SHA1:B0E9C09B2F1621EDC0482CFA6474F0FF1E123031
                                        SHA-256:4872389BEA563094492E06B11519EAF3F1A3FFA2EE8FF1F05BD2737B8D6FB728
                                        SHA-512:2F852E50D491F6353A7F005BCC2A2FC9E4C391C2E0FA184F10EC92BC8C7D72BAC77513E2CA19A314E375EDC57E8B6269CE00B0EFE02A830B333AA67E88E52896
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......>IDAT..c.neb`.0......_k.~.2..2}......w-.o....L..1.h1....t.a.........<....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-soft_100_deedf7_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):445
                                        Entropy (8bit):6.748188273788987
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+fZVCDygfx6n+PnrtT1pA+nzS+E3V+2EMiVw9:no19+fu3fx9nZjA+nzjE82EMr
                                        MD5:C04E9AD1E86CED01D2295FA5DF2D7B56
                                        SHA1:039C02919B57BFF2C4DF3A5A6AB8C50AC547D1A2
                                        SHA-256:7A101E445F20FFA93CB93B02A89368C92A9090CD8637DA607FD1874EF7418BE7
                                        SHA-512:F671FDCD62BB305713E16D98435124F784DA3F95325A3546E6D9D37F34C7FA606B61BD23DD8B0F3F0A6D3D5CC40CB80B8CD573BF3AB35DAC1EF6BF27262289D4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..=j...@...t)..N...P..t...%..=C...frw.EL.v).@E..mH......P.......Z._......*Q.....1......U9...u1mB.va6......._...u..:a{...h.O..*.U}.&..v..>2.5p......M.+.:.M.....u..1..>.V..A.../.9../^d...c...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-soft_25_ffef8f_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):367
                                        Entropy (8bit):6.40916101784247
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EiBRq9l+4uMxfqVH4IWFGT3i+GPuObzgN+E3VKF2EMiVAVTp:6v/7WogU9+Qqk4pCKIWFGT3dGPuObzSl
                                        MD5:870E4DA769784845BF381570AC584621
                                        SHA1:9BAEC551921D43CB38F47303ABF9ABF8251B26BD
                                        SHA-256:EA1D0790F41DE22703A5C96388E57C3646B597DCA181D9A0B9D3D729ADEF1D99
                                        SHA-512:3D027DACE55050E0A5A166E6B2FEA9A355626392D858B3FF4D1F5B915FF7F9744A2176E3F34B1534D753AF93EFEF26BA0AE087920F448919ADED54701039B5D8
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......sIDAT(.....`...W.>...&r..[.nK..z.. .1.<.!..$..0....{)......0..0R~..7...@...k....-I..]L....:........X......_.il..5./Q.6...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_2694e8_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770267640169761
                                        Encrypted:false
                                        SSDEEP:96:XNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:PHm231Nvu+wIqltWOe3nIP
                                        MD5:A1CE3CC448B059968BB35B71A5C91874
                                        SHA1:38D446EEAB80F7FBD7772B215267D6205B96EB39
                                        SHA-256:4A7C5EDA027930B4803E24985B3F5EF61E7EF7A5051350BB9E7282843ABA9660
                                        SHA-512:FEDE7B7F4A6DF4BA309F1E44E642EF2BA2242B84AB472CD07F582CBBDC02142AD349E4ED8593DBB1B8C6F3ECD2313B32F94C9026C08F131434C3A5722FE3DDA7
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&.........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_2e83ff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770844676212274
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                        SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                        SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                        SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_3d80b3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.768766204925428
                                        Encrypted:false
                                        SSDEEP:96:rNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:7Hm231Nvu+wIqltWOe3nIP
                                        MD5:8370749A3E90577FDB876D72E6935F8E
                                        SHA1:19FCD8D21F2C58AF5A00FA7335106A771B1AA04B
                                        SHA-256:2B1BB4B957E357AFDCC51BDED83CCCA68E8B714078FD5E8CFD64EB91863A66C7
                                        SHA-512:8B7CEAAACF6700C04EC27DB0D17B4F55B02FCE43FD950C2B634275CAE319E0030C10D9D14F89F0A34E479CF257C5166CD34A70F9430675A27405D85D40438E37
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=.....(...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_72a7cf_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.77096565541329
                                        Encrypted:false
                                        SSDEEP:96:1NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:FHm231Nvu+wIqltWOe3nIP
                                        MD5:505F6857CBA9AAD738957A7D3BB226A9
                                        SHA1:0A3A485514E98964B25F3BD96F2AE4D1AA0BE8B2
                                        SHA-256:882C69929DD8EFB562A20CAAA71EE3A068810C1F7A0575BF1D11C0A796A9B1BD
                                        SHA-512:CDE1BAA8306545454FFADBE58CF0CE8EBA08A7BF95DDE31CBFD1885C4032107F622E5AB67152040B7C92D5E3E3E42A9B5147EFC8249E90C8AADCBEF9026910B9
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEr..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...^....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36724
                                        Entropy (8bit):5.280856349526157
                                        Encrypted:false
                                        SSDEEP:192:10OW0wlNIb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC1j/w:cTIb/+vaW1e07VF5fyVEaDS25c
                                        MD5:2DA18ED46C347B06B53DEA4457D1A31F
                                        SHA1:669C6DBBB0CCE33E59120BF7A94CE704641A236A
                                        SHA-256:31917832E32411F18694AD6F7F10FEE76B7D35D45854E1E146D74A80FAEA3C1E
                                        SHA-512:D7AFB9AE8CDCE198F3502433BDECB2927D03747A72C7AAFEB127E5EF04401979F88664BD66679934D4A59CCD573A57816D00D25EB5F2BB2B9F143B4A290587D1
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImg

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29660)
                                        Category:dropped
                                        Size (bytes):31489
                                        Entropy (8bit):5.22480275794203
                                        Encrypted:false
                                        SSDEEP:384:cTIlcR8lOXHc11evNtKGzdlmm+4m6G9zKsSc7nfZBhVu:AXHcEN0Gzdw+m6G9zKsBhE
                                        MD5:C5518025B115C73BBEB9B8518EC0499B
                                        SHA1:6B06059A32FB214AA46167815A71BA15F8485EBD
                                        SHA-256:050DE6F1B8AB2984735E3A1F609784ADD67F48CB1780EA013D7B7477A7371597
                                        SHA-512:BA0FE9D9F4E7611C7F4DF5602FC7A34D6A256AAF775FEE3CFC52D2F5F29FEC089ACDBC4791210435DCD690EC5B8C93BF5F582B50FB7D1117C1B76D622E1D9DC6
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImg

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1406)
                                        Category:dropped
                                        Size (bytes):18070
                                        Entropy (8bit):5.08870989379537
                                        Encrypted:false
                                        SSDEEP:192:X6lNX1j/kIIF5fy72KEcUplA5OggmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc:X6T0F5fyVEaDS25c
                                        MD5:3041AB25C76FC2EC2B95B53E5D72C478
                                        SHA1:0052879B7208E43635E364DC0A6DEC5A06F92A00
                                        SHA-256:A606B8C796400C7763591C45ADCD217BA012A282AAA866C686A7AF4E9675B9F2
                                        SHA-512:05D6CC22AD3CAA2E937FE196F070DD984AFEB9CD6EAE67EC3717163849ABC936B731818592039B0AF99ADAB6FE8F125FE354B56718D8EE999D9241DCCE41ADAE
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=74b2e2&fcHover=0070a3&iconColorHover=2694e8&bgColorActive=3baae3&bgTextureActive=gla

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_glass_40_ffc73d_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):374
                                        Entropy (8bit):6.366478028228076
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh1r+UyKfp5En6rs3grEM5E7e+Vn0g2zgN+E3VKF2EMiVAVTp:6v/7J1r+U9+6rTFKe+J0g2zS+E3V+2Ek
                                        MD5:D54912D131FD1851FA51820E2F4563F7
                                        SHA1:F656629566FD2C94EE8AFBAF94B6307C61BD4AE0
                                        SHA-256:A1431E3400C4E0607BD04F20FF1E732D86518492BCD86EDFDA8A64D77422C8DC
                                        SHA-512:6C213534C64A68C44262058C76D5519E7741980BDB7F8AA57726C943BDD2457845C9D204BC9EC2CA52980E6F388E47F1E13C8543207918CA5A711E63DD50264F
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......zIDATH.....@...}.......f....&..Zh..&..:i.N......O.Z..~kZ.@..A..^.....3..AcZ.TRc.&.....T.A...k..U:...'.z_...0....6..`f>.....A.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-hard_20_0972a5_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):381
                                        Entropy (8bit):6.406906120742124
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJTc8RcXoYbaCb3LU+2BZTrn7q2zgN+E3VKF2EMiVAVTp:6v/7WogU9+G8aoYJ3TIK2zS+E3V+2EMr
                                        MD5:B0763946132B93BEDA0F1906EFDC591F
                                        SHA1:72EFEB7E6DDB671F04484BCE3C8B6A38CA1F6317
                                        SHA-256:FB8D6098D06455C35222B54887FBEF199B2FD2284DFB12195DBF0AEA92980493
                                        SHA-512:24DC3300CF4B68A6388FA7E63C8E1CA6D11F70D6C4B59699AB5E64F80120BAB71789652458DCBD89F15609F006BCE7AAAAE3F9FACFEA52F2407A0AFB97490E84
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P....m@.Y.3........E...[....@..@...................':.x.w....g(....R'..3.j....i..dZ.2.F..L.#.....j..K.p.51C......6.<...)z...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_33_003147_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):6.4893748429272815
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+YUKgyOXiP4UqIKlmagzS+E3V+2EMiVw9:no19+YUrQ4vIE7gzjE82EMr
                                        MD5:B7CFE8282BA59F5F94BEFB7A30688D0E
                                        SHA1:0D1F08900B23BF7464B34EDD54A54D5D83EA3BF9
                                        SHA-256:11C3956A49ECF039AEACB25BCD6A97AA55AA23964E1343BE0E99F73BA1952D0F
                                        SHA-512:84BEE916CE4CF35AF955A3EBC9EC9E8D1C4CAD75E0132FE4BE8A42A5A63969ABBF66EE5815FC8E3353D9E7FAC4668A3D7AF2CDBB54FC06CEF4111A08C6873475
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....`.._..Yc..8.S.K.KO.2R9.h......n..,.:.&V_....R..w.....N....j4@Q..0...&.X..3n.=...c`./91.w.......'...<..v....-LX....,...5{..|h.....K?.'..e.h.(....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_35_222222_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):6.142862152003425
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOk/vt9cG/rPPA1ZgX2zgN+E3VKF2EMiVAVTp:6v/7WdU18g8C2zS+E3V+2EMiVw9
                                        MD5:A3437EB76B200E5987417ED57B97A0C6
                                        SHA1:36C18C07EF26D2FC01D714F93DBF238BE292AA12
                                        SHA-256:B2016DF4E2E19A17838CB87DBB6596C7CE7224F1891825359B92EFB470BBA90D
                                        SHA-512:21403F52A34E87BD0C8DA2AE48232E1E3E74B7A7FBFC863DB2FBB2BCFACE97F36ACAA1892734DB680822519CCF837F515974FAA68858F7E06CD545FE2A6D7088
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......^IDAT..c.....@........*..[L.u...g.w...=.....N`.7...1.....L.....c.;...}..:L..1..3..eP.a./F/.bA.$. .;.0...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_44_444444_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):328
                                        Entropy (8bit):6.102952359110676
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkRUNdnnxLzw2FtjG2zgN+E3VKF2EMiVAVTp:6v/7WdUgxLzpj7zS+E3V+2EMiVw9
                                        MD5:BC42CD9F99AF4032A166A1433A8B5DC7
                                        SHA1:9F0E531F7E09D1F75A9F1967614D05DC2C49EBF5
                                        SHA-256:234DF09388C6338E20CE45E4EE46F946284863FE1150290F134504A910C35147
                                        SHA-512:C6696458597013CE9B03A98B0DCBBF9919858D1D686B62D8C8BF4920116418367AE968BA4FD185ABC08B895D4B59EE17EE187CE0B5F98BD5F4C2EBEF072962C4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......PIDAT.....0...5.H...u)...(..4B....3...c6.*......&.9.P#..9.. ..WVT..c.u.....#2D..?...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_80_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):335
                                        Entropy (8bit):6.134607764700383
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOk+horavt0CSSZq1ekAYUlr2zgN+E3VKF2EMiVAVTp:6v/7WdUITfSSs3A1gzS+E3V+2EMiVw9
                                        MD5:1BEFF10685B7E41D107652442EAA77B1
                                        SHA1:E605411EBF86AAF94882ECD0BF7C2C57C94703FD
                                        SHA-256:1BD38B24DB181616A1C3EFF5DF444E3D8E33E6C7B620BE748ABE2EECC4A4E240
                                        SHA-512:17A7CB46B69FEF95FBB313CF998526FCD2F6895FFCEA69BA90F370F35344B4AD7C7BC217111B63CE1C56188E521CFD786073248B48F32CEDCCE445E35700E3A9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......WIDAT...1.. ........v0.......8.......W.8s..<.NPE......!.<..IEL......M.\.0..N.%4x_k...-1..W......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_loop_25_000000_21x21.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 21 x 21, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):378
                                        Entropy (8bit):6.463279097928892
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPtgWUyKOkfrE+kPymX7dN33SJzjEIVKzgN+E3VKF2EMiVAVTp:6v/7lgWU1rxkPymXZd3mEIVKzS+E3V+W
                                        MD5:3F897551A356A1DA748CD9BAF9F297E6
                                        SHA1:023DEDBEAAE7F6CFE6305F66D8951FC12D7704C7
                                        SHA-256:87068005C88A9BBF33DFDAE5A6452C81D9932E1061B40BB6C2EBA332BE73E991
                                        SHA-512:AE35A9E26016DEA62EF39A3602FFFE15661704351CBC91D6F23C259D7B83E2B18BE586E923DDE9A2332C6023FD909EF1C134EDD7BFDA5FA8BE5FADAE630452FE
                                        Malicious:false
                                        Preview:.PNG........IHDR...............&.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDAT(..... .D.,._.O...4~.?.q.2.vI.$..."..O3'b.z8.....E|.|...Y..7-..YM.U3....PV..+...hT...s..v...+Gq...5......b<...o...........u.@......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_4b8e0b_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7718687501842405
                                        Encrypted:false
                                        SSDEEP:96:mNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:YHm231Nvu+wIqltWOe3nIP
                                        MD5:853C2373C51B7B7C545D092D4A98B3CB
                                        SHA1:12270D908EAF7EC8C1D3491C4BFB00414911ED38
                                        SHA-256:FA33C9FAA259211591EA1C144246F1CB01B3CB18FD739FFAAE0A4965B979FF97
                                        SHA-512:89CCA39CACFF95B8DE1D1C29B8587EBABB91FCA2F91EAE1F491F3410C7549981E80FBCD188AF7DB63DF94ED7D2BCD301082C50E01B171308F76931EB2CD574A1
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEK..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....]l...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_a83300_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.745691045674909
                                        Encrypted:false
                                        SSDEEP:96:PNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:nHm231Nvu+wIqltWOe3nIP
                                        MD5:372DD47E50840F48E9098AA30D978A5D
                                        SHA1:49F2C2A59C0A53F5400BC19F2F66E516699CDF74
                                        SHA-256:5D119EC862AEC3BE0B0722B651C5FEE065AB8255B0DDAD3D01E1A6B929B7DFA8
                                        SHA-512:9E24AAE1EE5750587C76145C557117E51A04E4B8EB0A56A4C2A88F11808118E2B33575B25AB2AD062A1B5862DFDFA7EDA2B11F5D15C1CA3DF9927D7DB81498F8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....g...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_cccccc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7034
                                        Entropy (8bit):7.932139241999848
                                        Encrypted:false
                                        SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                        MD5:883030509884C748B039641F5955E85C
                                        SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                        SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                        SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36670
                                        Entropy (8bit):5.279756253570595
                                        Encrypted:false
                                        SSDEEP:192:10OW07ABb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURH6CrjVb:3Sb/+vaW1e07oF5fyUE+DS25u
                                        MD5:9F6A7C59CB79262E433FF8CB4DCB6263
                                        SHA1:7FA3C00C899E8F02C5607C070AB03E74E2CEC924
                                        SHA-256:E37D1F99DB0795BCA172C98AF91FBDC2CA55806241823916339B6E0765C2D375
                                        SHA-512:C32BADA6D271252248F1F8CB9411506617EC4D61666CAF1E4A4440B0AD664B65762F9BF338130005548A89D527404046E9BCBFA5214475D6CC4E336E333F5CC6
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29589)
                                        Category:dropped
                                        Size (bytes):31390
                                        Entropy (8bit):5.222338758092407
                                        Encrypted:false
                                        SSDEEP:384:3SlcR8lOXHc11evA4zkm++446GpbZ3Sc7nfZBhVz:tXHcEA4z1m46GpbZZBht
                                        MD5:AB75E96AD411C10AC315B1C104BDB58A
                                        SHA1:101AA2C7A353A19DF8005BA093AA3082B0FBB650
                                        SHA-256:7999E267C2C6C051C6CB70E776DEE5EDE2A291BF0383E7767B502F4CFE4D58F8
                                        SHA-512:4A0EEB728E6A512E18DF0CEA8F1321339CE3DC326EC672408A574A4734C825E21D57CC529489458278258B778E06AE98BF491BCFA223742BC8A6ABB9E1DD9820
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1378)
                                        Category:dropped
                                        Size (bytes):18016
                                        Entropy (8bit):5.083484636552025
                                        Encrypted:false
                                        SSDEEP:192:XRASCrjVnIF5fyIS70EcS1poqZGgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhn:XRdF5fyUE+DS25u
                                        MD5:6D93DC6B49305078CDC92FD8E2F5B068
                                        SHA1:1262493B0C501A3452A430E9726F22E23107F73F
                                        SHA-256:9EF7AB8ACB7D9D64C5DB0FEBB181051F48DD21B16265CA5A42F6997CA87CF7DB
                                        SHA-512:C14F54720D8F01B34D5385DEE986AD013C6608E696D229C159B07EAFDC285DE1A076F81DFA3884DFDCF4D12974E82DDD7CBF07C13361E12452408A40E87A52CF
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&borderColorHover=0b93d5&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=0972a5&bgTextureActive=highlight_hard&bgImg

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_diagonals-thick_15_0b3e6f_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):482
                                        Entropy (8bit):6.731455137882688
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+AfHu+wsqBaud0rPo3/HayzS+EELEMPS:X9+vXsa5dH3PzjEELEMPS
                                        MD5:3FB571A70BAEE9CCF436CB7444655F4F
                                        SHA1:FADA5ACBCE5E3417064B121397DD5DAA59EF300B
                                        SHA-256:7767B62C04F6012A35581706342FED2D508337E4E56EEF8AB5AC3A0FD28117E2
                                        SHA-512:73B79B930ED70A66623572758C5E693827133A56BA7BB96CAD02ACADEF41BE9314B9AF15929AD8B139074D19B8538A9EFA9D39121AF4EB32BA36DB0D31472481
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....A....N. P.....`(.{....T...(.A.$A.Mv.;...g..3y.......2y._...Sf9-....?...j.L.&.lj..@......z.Jz.]..*..rW...*0.Z..Y0........5..P...Uz..[........0.Z.&Q.`.5..R.`65.{.J...M.N.....0...S..0...=P...5..P.E.....0.*..m..q..e!...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-medium_30_0b58a2_4x4.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 4 x 4, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):295
                                        Entropy (8bit):5.8403310516544025
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP7TCUyKfp5EJ4/It961yltYDIG2zgN+E8VLEMlVbEbp:6v/7SU9+btFtYczS+EELEMPS
                                        MD5:F18ED3A85803A0A5F7AD022481865788
                                        SHA1:1036BF67D25712B952886365C3C172D21D1180B6
                                        SHA-256:BAA6735F2CABDA61DEBECEDFC1F2D6EC88B80B4D09072E63F513C875DBD3CFFA
                                        SHA-512:1ED7C77032A9B4C26C3EA2380E9FFF68CE9F812E27F85C874A8CB36B4BEA589ADA01337E451D688ED3650C2DD3548B79D2DBEBE69F8B404A7AA1213743C9CD4C
                                        Malicious:false
                                        Preview:.PNG........IHDR.............v..j....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......+IDAT..c..X....0A(...|...E...@.;...~..,............%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_20_333333_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):266
                                        Entropy (8bit):5.450950367736609
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPg2pUyKOkp4/Qk3hjsxzgN+E8VLEMlVbEbp:6v/7I2pUEgzS+EELEMPS
                                        MD5:AB212BB03E3F0A9BFC602E66A66A5B52
                                        SHA1:0C670C2D8F309DF83B7D751D203CE1B2BA936175
                                        SHA-256:70D6178C8CC51943FF7BC50F3B5E9532BB5819A38A2C8AA35A07F90FED30AE7A
                                        SHA-512:90B36A53DDE5DF1D845A590AF4670557CE81A7240FA93E65CED9C982694F27B820A65B8E8EBFB538A13D2DA6B07C52356C111D8AFB7C37BC5783224DB0A71A60
                                        Malicious:false
                                        Preview:.PNG........IHDR..............M......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDAT..c46f``b`.....8..e`.P...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_30_a32d00_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):276
                                        Entropy (8bit):5.6290628196886745
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2+UyKfp5EJ4/izEpllIzgN+E8VLEMlVbEbp:6v/7ZU9+J2KzS+EELEMPS
                                        MD5:49BD4C1ECC0B3DE7361A173739B42D09
                                        SHA1:79DF813E194FD54B0FF5815E239E0BB63ADAB343
                                        SHA-256:D5B2FC96836D2CF7D20F26F934CDAF978C59B08EC1F7B321D5BF23EC92FDC744
                                        SHA-512:9DCEC21CE1467B596F63C9D3915CC5FE2435ED5AE2ACC245D6FC1FF852E2B68A325B96AD45FBDD4C00A491AD00421A742AE9FC0F84E2347F10E17BC7F27A1C9E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c\.XW.... ..K..j../..,..Z....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_40_00498f_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):282
                                        Entropy (8bit):5.635984033684598
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2+UyKfp5EJ4/8kl7J7FyHxIvzgN+E8VLEMlVbEbp:6v/7ZU9+CN76OzS+EELEMPS
                                        MD5:05D7305DFD9AF99188E21D18C608E250
                                        SHA1:3A7C3BB198F46F3B71A539A73407A75C0B8DF223
                                        SHA-256:49584E9E9A3D8B1D999E047C3D33E2FA534E5CE08A804B02F52624FBE544793A
                                        SHA-512:FA1EDE1473FA1A615173200BE68AD4240FDB5886BC2783E920BFDA0B3687ADD9E8783EAC037737BD613162F0AA943602B06734B9870910A20F9839392614E31B
                                        Malicious:false
                                        Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..cd`....g``````.P.i*..'..*....D.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_gloss-wave_20_111111_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):3990
                                        Entropy (8bit):7.891474477620868
                                        Encrypted:false
                                        SSDEEP:96:fcZXXXn8g4P6kNt+zEeY1ICwThkhndsqJamy8rApR+7q+S:04P6Zwp1WIndbsgjq+S
                                        MD5:0D7E9BC2B8DB61A4B7A4D55044760EAD
                                        SHA1:00323D927D10A18334079F55B5B1A92AB00FACEC
                                        SHA-256:5240A391500CF005247EBBB2662044AC85EF065BACB88ECA5D297837D733FD1A
                                        SHA-512:BAB006B5CE949D0096648E34C2B290E406111565416E1F2820915EC646364C7643FCD67B61FD030972D9498957DDFCAB9EE3C7FC53CF5CF46BCEA2D461D2C668
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..].......o.*.%.E..D..!(.i#p1.:./.p.C`.^..*F......l1...c...q..{....9U......\....4..... .9.N..A....t...8..b..@'..... 6..t...8..b..@'..... 6..t...8..b..@'..... 6..t...8..b..@'..... 6.=..k?.k.`m3.Mil..-.G.Q2Z.z.Y..z..m]......}.v...8=Q[...Y{.W. b`.k..Am....f3.Ql...}...%Z.....#.^..d#0.(....:._.S..x...K.I..\M[ .km....M..k.+.....R.cF..6._...Y.....$.z2......f...#F.....y^.....f.ki..iP...R.......q.... .........N....4.".o.4..D......)......r.$G..../..tI-;...H[..1.i...*..2.@.E.H.E.;.iF3;..4..i/.H0/.{..G..>G.....z[d'.0z.GI......#..a.Q.C<j...Hy.s.".6........&Rj...NuS./.k.ZOr]o..4.....}.6...C[.1.....Zoc..R:....K..Q....=.....i.md...........f..A{..{.>..j.......].%.....V..8.|O.:-'6.~<.1fc.9).~.. .98.N...'..b..@'...\.}j....o... 6.^....p>||./..#.Q...\b.|F.U...m...x....-.AK;b.\l2....V.....y.3O.B....n...7.\-.8.,.I\...v^.$.,.y..K~...A....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_00498f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.738397057708785
                                        Encrypted:false
                                        SSDEEP:96:S3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                        MD5:409DB4EA7A4679B64D9903E558897637
                                        SHA1:A5BC4583C783DF4AEE4C5B234561FB1C8E4C31DE
                                        SHA-256:BB348EFA46AEDEF89A18A0256964A1E17525975EDF9CD442C7E2FD0DD40113F0
                                        SHA-512:A5D76876D39182B924FD93ED3B6462C9FA7378184FBF9D19FB0D91CC0CA1EF7CA8C32054168F5B399EAB2F49AF0487CE4887B2C708579F61C601F315F1A5FD05
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I.:e.R...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_98d2fb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778170418989979
                                        Encrypted:false
                                        SSDEEP:96:cNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:GHm231Nvu+wIqltWOe3nIP
                                        MD5:2979CF4F5560012AC1C67573A43D1405
                                        SHA1:13BE8F99080E00991795FDEA751353FA8E75DCBF
                                        SHA-256:1F1D8BD9D4CDC3919D74287BCD9B3C0A7533E5407D05043C0C2F2BF7D1C0F436
                                        SHA-512:21676E992AEE427E3D0A7494B1B8D37E319CEA3FD52519CE8B0D29D2D8489125C6FE9D1A5A2DD494B93523AE0AF56644ADCEABDF8B49EE1F0B56A883817F5142
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_9ccdfc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7732597452877
                                        Encrypted:false
                                        SSDEEP:96:qNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:EHm231Nvu+wIqltWOe3nIP
                                        MD5:99AE47587576A1A15CB7B15C67F3545A
                                        SHA1:C6D3E695CAFF3DE7F9EF47873E543E6B0C0FB4C1
                                        SHA-256:4015F92E2862926B030463D1D94548059604B362A272CA12E66E5D0A11600635
                                        SHA-512:FDD3A8A55AB5F59A7A583C5132C30690EBB67882094E0E895189111BF8AA455E703234E2033F05BFFA141CB617D7E48BA6D8825A069C1874C1136DB24AC99E28
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36540
                                        Entropy (8bit):5.279669592134456
                                        Encrypted:false
                                        SSDEEP:192:10OW0XXmLjVnb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHuo:rXmVnb/+vaW1e07qF5fyEECDS25ulak
                                        MD5:008B2CC14D63BAAD9AD3ED34F27BA400
                                        SHA1:978BF40F9CA08495E0DF2150890AAA20B6BD03F5
                                        SHA-256:9CC15CFC0AF0DEA3577DE02C4C5710868B84DA3D32FE8A5A39EAE1E87C336DA7
                                        SHA-512:7363DB6DE432B0A6F763FD05BB6469D6FCCAFFC7DDE22684469DA3D336AF58663F93B69601682D8FE4FBB7817F1714AC29A963FBEA9D993A9085B7849B41AE10
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29509)
                                        Category:dropped
                                        Size (bytes):31287
                                        Entropy (8bit):5.2226618941796215
                                        Encrypted:false
                                        SSDEEP:384:rXmVnlcR8lOXHc11evMf+8mzkmAW+4x6GpCqISc7nfZBhVFWGc:sOXHcE58mz1AOx6GpCqYBhM
                                        MD5:2305D06C48CA0D210D8A3DAF72019233
                                        SHA1:278E6B52466C2A13308D94DA327DC20D4048B2E6
                                        SHA-256:B5914589E58247E40B3D224AAB415A049674B5EC805C13E6A0D41F871FE9F9D5
                                        SHA-512:8466242B348C59A296274306215CB787C0E4D55944390851E0D141D7C8C7DCA092CCE847E5983A4F9E1FE76EA77BC79955396714C722798ED995A77D82527D33
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1355)
                                        Category:dropped
                                        Size (bytes):17886
                                        Entropy (8bit):5.081970292059026
                                        Encrypted:false
                                        SSDEEP:192:XNXmLjVUTDziAF5fyWy2EcA0prtOIgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhdlR:XNXmVgF5fyEECDS25ulak
                                        MD5:2E88AB19BF92243A51E13D0B6CE0EE7F
                                        SHA1:AE106A36C01FB6B08538B69AF49B60BB4E7823C4
                                        SHA-256:687AF36230D585492083648BC22EB68A1E27990716B420BD1884415A9D74D888
                                        SHA-512:4E4CB4D91FCB5BF711E295D32529FD45FDF29AFB72029A30CEF224BDA53C294EA92EB2F224B1769E7BB10E64AE68FF0B036CD282BDA702FE88AFE1D6114E4901
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHover=222222&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=292929&bgTextureActive=flat&bgImgOpacityActive=40&border

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_gloss-wave_30_3d3644_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5999
                                        Entropy (8bit):7.691482100292732
                                        Encrypted:false
                                        SSDEEP:96:fHClGlTr0BkxPKNexG1FUtdLdkQZVRm35XN4eyVI6yYGcTU/gF6FrM4B98625srx:PCMhxPKydkcVcBN4eyLyYGcQ/HpM4B9L
                                        MD5:F36FCC39931731535915E2DDFDBF3947
                                        SHA1:60BF6CD036594601733C7E8E12CD22033789B2EF
                                        SHA-256:3A11AEC8A7D12CBAEE309A9D4C545F8EB64DE46E5C24BFDA11119C40FF94EA46
                                        SHA-512:A513886D3B211500FD06AA7AEEE9073D0AE843245B6613DF334A9336FE651096AFBC23EDE8FCEC7E2E361FB86F63B441FCA6DE26E63115542FC05048099ED64E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......sIDATx..].%.u.{n.".K.^.. .@6....|$..#.Bv%y.rd.F`... !.D.B Y..../..XCp...^.yI......c...=.!.!......<.......OUu....A.[]u..9U]s.....9...}=.........................+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V.....a'..Eo...g.l..,....y..OS#m.4.:..r...o...(}].qy....dVQL.Q.Rii.)..U....|}.b....k_.%_+..9kA.m..x..Ea/....j.=1_..=.*.{.I..Gd.....UUb....}...G.t......*........2.zg..ghk9?./W..........p....$.=.....'.B..E.>.8\,.i.B...O).iy.y'5m.......C....;...;..Wo.Y.i..........!...}.|........c.U@&.......Y..;...........*.......pp.....X.f.<\o...U..^h.....Q.];.>};...Y...u.W1.bz..:.J*9..E.G.].!.m_..R'z.s.+.gN.^e...YV.+k.....j..=..]..nJU.){.R-...........(...{.~.K.{z..!..d.K..kA?......x....9..d6-..J....;.>.....a.....m.f'.....t.w...Z.g.m.,{-...y.......&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_100_dcd9de_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):400
                                        Entropy (8bit):6.509967114205884
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+mu/aCDPqNiGwkWXzS+E3V+2EMiVw9:no19+myzMiLXzjE82EMr
                                        MD5:5D491F7B87E945DF741EACB3D368ED05
                                        SHA1:E85A361D1DEBCAB83DE799F29ECD4754A518CAE4
                                        SHA-256:902CA5DCEB7F066FD3830E81AA40FD261A4BF4F11852D259F557B88051C4F376
                                        SHA-512:E6FF0037B706294D556030C4DFE04BA48165F8B2B233BB5BA5C2BCBD71013C466175207EB1C544D9370930D7F42C2527185EF873E9D7B512085965A2347DEFB9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..;..@.........A...ZXY...z...6.H$..iu%..~...'P........o.;.$.o.R.Znt;...i...1ce.$L....h..:...x..9.h.....7..>l8.[..c)..7..U.8//s.eQ..._.qx..Ml:.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_100_eae6ea_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):431
                                        Entropy (8bit):6.629498745211216
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5Eil1m0UFAQNy7VtY70PkBJyj2zgN+E3VKF2EMiVAVTp:6v/7WogU9+2s9ynY4szS+E3V+2EMiVw9
                                        MD5:0833FE23D64DB51677CB9F8BEF35E10F
                                        SHA1:61528D6334E88224E13B309F524CB01C5DD29871
                                        SHA-256:F08B09D7F06D2E57475985191A7EED6046022A218B7238E8F51D43E786E34E18
                                        SHA-512:334C81EDF50FF9A61C52AA8DEE7DD4EEEAD8A652377FF037BDDF36C3B53D97462A820DA82E04B81FBABAB109D6473222962F7F8E16D157B75C25389FA078131F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..!..`...}.@`..y....6.' AQ...%..w0p.....&..GD....g.+.fz.>.[...RCB....$.H....&....)z.;..T.^T.e..e.G.s..^.Cv8$..p.F{...#C.p.Z...=^.7.+C.*c^.x.#!b...t[....1.U...!.\.oW.q..bY`.!.;W...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_25_30273a_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):420
                                        Entropy (8bit):6.606028187820867
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+tSksqcRcltd2d2uSQCGyzS+E3V+2EMiVw9:no19+tXsqca9OSQpyzjE82EMr
                                        MD5:C1910C93E28B98D5AE0B2F2B1B04EE22
                                        SHA1:F36314A03DEE387C90EDCDD88AE5C6BB1CB484C4
                                        SHA-256:65B5314B6F5D2399314FBFF4617560ADEDF496B221E15CC9B5D4B92595D2B28A
                                        SHA-512:9BE84A7D68C0E129863F4170B8B6CF0420A2B530703BBA5273AE220455EBCC2F75E755E9256C8EF7AD657506FDFABC2AD82B852FEC3F7DC33CB4DC1C003C1E9D
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....`....0N........D.-........q..................0q.....+.8.-..MEDD..g9.EY....N....Bi.a&.......)3.=...L..(V.`..b.Ee&..Vxhc..H..3Z..9.,.w..p..Q.v.a ..A..~./e.d.z;E...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_45_5f5964_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):405
                                        Entropy (8bit):6.462769543492536
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+yI9YAi0AaGztnzS+E3V+2EMiVw9:no19+IAibzhzjE82EMr
                                        MD5:88961029455F0C3A5066CB34D7814023
                                        SHA1:D475886D45EECE8598892B5144F569DAA93114E7
                                        SHA-256:D8AD7211C34EAF56349C6D629B4C740947E0F774E2693216155BC820AFC6591D
                                        SHA-512:19320CC6EE4E69F57846B847C55B837C2B17409CD019DB1B9108AB5D9437C89017FDD73051FCFC676BC56599B54610309A18131BACEFEC5963E65012884D5F90
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....A.D.&G...8:....k....6..zN.. .{..g.X...3.M.4...%..dl...k......v.+...^NG.s..\.a.V.Y..g`.c...{..`.)'./a,.Mn..+.....8)+.6z...X.j...zB3M5..K?...Zm....L...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_734d99_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778147156719075
                                        Encrypted:false
                                        SSDEEP:96:kNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:uHm231Nvu+wIqltWOe3nIP
                                        MD5:049AE0FA0D5115E50A85DAB704272EE5
                                        SHA1:0596A3E153C7F8976A78553D6E3BAF492CA1C81E
                                        SHA-256:584A79C0AC285D669F287C6AC494AA4549818231CA4C7C37120AA5C872291221
                                        SHA-512:CD4FCAF571532AE4F74344BC0261B748482E6CD84AF7FCB8EAF1A71A8A7D823A305042398581A7FEFBC9B764A10B6BBC7B21E538A4E534560094FCC9F5571800
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEsM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_8d78a5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.779787835398036
                                        Encrypted:false
                                        SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                        MD5:1388573ADFE782CDF788544BC92118D8
                                        SHA1:3770D75FA62E144B7BC9ED4B1703D52733A99B85
                                        SHA-256:46F15CFD2AED013ABC792664D8CD78E0A7F6A76ACEB31A4D4C4688CEC46610FE
                                        SHA-512:1D396D2D3FE96FC48413178F9A39075B52A4A8A6DE5D9220484585F096D39ECD8FF3254D0A630F583E1067D0A51C24874D5C2D2439736393AE7548648F31DC35
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..=.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_a8a3ae_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778042983270137
                                        Encrypted:false
                                        SSDEEP:96:QNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:iHm231Nvu+wIqltWOe3nIP
                                        MD5:EF31D50172093B1F64CFADF1B8292CF0
                                        SHA1:0E1173B04F2A1888F5C829179DE59B479F6944AC
                                        SHA-256:3D0B1E030A2186F8A5D5FDF83C902908AF76035E43FE2ADC989627B419D226A1
                                        SHA-512:3FCD547B4540D4C09F7D9843386DA1B1088FEB5B7E3D219531D7513FA377E75478A74DF58D077AC5BFB864321B31007EBBAF038C9F72732C4B016CFF8A3C1BBF
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_ebccce_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.775735413327992
                                        Encrypted:false
                                        SSDEEP:96:HNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:fHm231Nvu+wIqltWOe3nIP
                                        MD5:6F8710413AA2B910A26426826BB516F1
                                        SHA1:DD3286F638EAF535A1797A12DF194195A9E98484
                                        SHA-256:8A9CD6D04D46342763433F96D2B96B14C73F39AA5183D22A68C18F5BCFCBF929
                                        SHA-512:5E8201C9140EA10C5951CB4D5299BDCF9B893068250C5730D1FDFB35D567DB37D304B0BBC8C6842244319D092C563514E40AD2A5398F749D7EB7E0D600B31EB3
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36594
                                        Entropy (8bit):5.280448617485699
                                        Encrypted:false
                                        SSDEEP:192:10OW0o4b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHCqQPH1E:U4b/+vaW1e07CBF5fyD3ErDS25Y
                                        MD5:48B634CC145D6374F451520CC9638311
                                        SHA1:D59AFEC5961C41885AB365E29005B02730DAD09E
                                        SHA-256:4528E977EAE52058B750F9D5352D814E29A2BD8EDC1BCD329402E67E68B295C4
                                        SHA-512:8CD14F776D95F145672B6E1A0CA1C44804AEB43F3F4EA72BC7AFF758B587146D5134D2D451061E57B69148224BFE11CD5AF14A5EED0A5AE9673B9C94B91CC4E9
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlig

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29532)
                                        Category:dropped
                                        Size (bytes):31350
                                        Entropy (8bit):5.223859065827434
                                        Encrypted:false
                                        SSDEEP:384:U4lcR8lOXHc11eveVazOm0+4l6GVEPGSc7nfZBhVk:IXHcEeVazjgl6GVEPqBhm
                                        MD5:361D1D4C0FF0AEFAE3F9807DAE3572AE
                                        SHA1:A2CA23A18D57C9800F0B4FD03D3169DB4FDE8DD7
                                        SHA-256:7C6C400B8D286B59DA3CFC10E53A1669F340F90B4CD48515B9FF7EF8349E1FAC
                                        SHA-512:7FC0D21ACCF6E3FB4776D8B37B72754FCBA43C8EF26BB4FB9748A77C0930FF62E7540814AF742F10134185682DA3FA856B16B1DAFB4F65ADFD90B469CE32C9AC
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlig

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1395)
                                        Category:dropped
                                        Size (bytes):17940
                                        Entropy (8bit):5.086626971912176
                                        Encrypted:false
                                        SSDEEP:192:XyHqQPH1LBF5fygdwWmEcQEdBs7rgmB0iBfT9RhS2wV53skuMaaSQhQz0iIh20:XyZBF5fyD3ErDS25Y
                                        MD5:6D58605EFA0BE1BA65372D9CCFD510CE
                                        SHA1:AAE121EC1FA89DE991FCBEA540AF8E423FEFEEF9
                                        SHA-256:06247389586C2705B4DFDF601C751B04847EB3641E3878F6E97C230C121AD4DD
                                        SHA-512:641E17A8E793D1902C9BB6EB6B9B04CE4986E5C025154066D3C0753DF874DF0CB11F6C06186475DAC252BC44B974DFE96CD14392F4A56414E5930BC70AAF6860
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlight_soft&bgImgOpacityHover=100&borderColorHover=d1c5d8&fcHover=734d99&iconColorHover=734d99&bgColorActive=5f5964&bgText

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-small_25_c5ddfc_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):400
                                        Entropy (8bit):6.3943414419884546
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+qFCYR2oQApEsHyszS+EELEMPS:X9+qFfgoQAp/HyszjEELEMPS
                                        MD5:E28D9FDC77D1CABE522D76F6A8431E2F
                                        SHA1:6EBF1C38D3C4264DE61AB7BD15432E8615EB39A3
                                        SHA-256:9A86ABAF12D82902252F5D18B7EE2972C9605FD507AD279E22F1F9EE53F58599
                                        SHA-512:AF0930A931FDF089D67527A60364B2A088B704C72ACD9D182CFA65F841B89850B39DD7098F2DD3A0F2305AFDACF22B611921FF3257AB2099655BA7E7E71A6B5C
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.DQ.....]PL.`2f@1A%#.0..%`.......y!..K.^k......=..>).?..h...{w..).?`......0.1..1.a.c...vH....K.0.1.a.;.h~..%b....0..R4?...1../....y...M....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_20_e69700_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):475
                                        Entropy (8bit):6.752318098655858
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+b04gBOdOrEBOwZRHRg8iPs4OQ+Z+yzS+EELEMPS:X9+bCBBIBfxg8x+yzjEELEMPS
                                        MD5:A64F6F201FC8C651C5C88BB4035CC0EF
                                        SHA1:24FDBC731401B085F7C115819C797E83B45B8945
                                        SHA-256:2DC875A19C0884466AC284544BA2E1C6F8D64B0A5C070AEA8837718DC4E7239B
                                        SHA-512:54BDD1A57E96F432353457778015D759311A0F5687FD088CE1F6C9A7FE25F2DBB49D4F8D013F551B55B5BF0C5F5E8DF6E24EF7909E06AC3185B49F56D7A68955
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.F.8.tt..$..:3.g.v.b.J$.....>$.{...8.../=....>......L...q........PM0.Z.......J..m.k..j.^.K.\.8:U.&0...&Q+`...S..0...{.....D.*..G\.....H....Ku..S.`...L.V.<...R.`65..@Uc........&Q+`...S..0...{.....R.N.Nu..S.`.U}..>.........%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_22_1484e6_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):467
                                        Entropy (8bit):6.551733813034693
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2gUyKfp5EJ4/KaMpTYOvJE+SwNrzEIs5lwKSlQdfNiCxzgN+E8VLEMlVbG:6v/7egU9+LHX9REIUSIiCxzS+EELEMPS
                                        MD5:E3B17CD6A93A1119D1974390B693906E
                                        SHA1:61071377D2C6B7CB7A9F1569D58BB194BDE6A8D2
                                        SHA-256:70EDE93717F645F1BC66F67CAF12B885ACBE60DE378F61088AB2B607F9CB92BB
                                        SHA-512:EB251150CE1DB402F7F5E75BEA8748463BFEE4FC1E2E46108691B2C4973C6FAB4E0C05DD35F11D5852572F4E07EE869AF746B6D84B3ABE320ABE16DF5452DABE
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....A.........(.^h....A).`. f.&.......zf....]N...95....s..9.....^.gw.Cm.....M-..T..P..C...8;....A.....0...S..0.Z.....:X.j.?.3R...y.apvj....I...Gm.....M-..T..P..C.~Zt...D.y.&.J......@u....:..E.....0.j..".....m:...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_26_2293f7_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):464
                                        Entropy (8bit):6.63752038608698
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+RcLO80YNJoroGsPoGs0j2zS+EELEMPS:X9+SLu2W5sPoGsQ2zjEELEMPS
                                        MD5:1E83CBEA9DB15BC529ED10025F161EFA
                                        SHA1:5C10F56CC53DA52E4E781D4ADA03DF32DEBA4250
                                        SHA-256:A9AC1DB351456F78CED0DBC0B1A4EF42978AA13FDA297854320E92532E185D2E
                                        SHA-512:89D18E5880F26DCA7C014221993920279289D6AC4047ECFCB98D53480BF9C088D1945D0A7E2AB0AFAD9E64F6CF7A7D7033D906E95F86EFE3667670DFC8E3A6D9
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh...!..A.D.e..,..58+..*Xn...!.i3.tf.A..T.N...\...{;9y...9.sz...>z...Y.....M...T..P..C-..pvj.C`.u.L.v.<...R.`6..+P..C5.......H-=..K...S.`.u.L.v.<...R.`6..+P..C5..u.i.C`....Q]0......X.j`...u..O.N...S.`....2....#.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_highlight-soft_100_f9f9f9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):325
                                        Entropy (8bit):6.042377501793925
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/nhUoI5s0GbzgN+E8VLEMlVbEbp:6v/7WdUChUT+bzS+EELEMPS
                                        MD5:8B553361D5B0873A7CA47A8431F411FF
                                        SHA1:AF4FF9CF0FAEF9F03F793AB10781F29A8A01707E
                                        SHA-256:07CFE84A9D3C68A80CE8C878E53A092E25346F43CDE426582958F85A8210B025
                                        SHA-512:95D90602B49B61C5A5D6C09D6D14DD17A241E1B275C9F619A597B6524B993272C0E5D6F2F225183BC1BF523CE49F5FFA9129610AB2656B04E9FAE1926951BEA3
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......MIDAT...1.@0.@...qyw2.K-$..3.*\.,y.x...*Y...#.E.D...'J.(3.@.%.&.dY.=.........xI..C...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_inset-hard_100_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):314
                                        Entropy (8bit):5.943498819236378
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/Akl27opeLDvJX4wbvzgN+E8VLEMlVbEbp:6v/7WdU62A8Dx3bvzS+EELEMPS
                                        MD5:ED49819A8691DD27D0D1515C1BA3C23A
                                        SHA1:F9E91232D206E59CC1132312B9B4C0040A3F39CB
                                        SHA-256:5239FF76C9F2A9F6827A5D8C90632E81B67C64B2A326A38FB7A10CED6A4DAC78
                                        SHA-512:3E7D5BC375E901235D05346A52B9C1A5412D6CD8659409C479C92E4FED04B4E56005FA2DCBF8BC08D3BC8C7BF69F45A3B091E0403CB4CD36BAB2AA9A2AB71A31
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......BIDAT..cx....a`..{c..g..W3|4e.$.......&..L.....31.c.!..c3.O)&...t'....|..D....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_0a82eb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76566668388668
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:9FF8528D9DA88808316D02CDECADF673
                                        SHA1:FA7FAF603910CF3FB79B646296F154F23BB837F3
                                        SHA-256:3892107CADDFAC58F15140C2CA6FE0D95C94650D1CE16E6D69529A88B6FF14D5
                                        SHA-512:5B5EA2C588000EA657C36AAE88D83FE9DFE176D01EAFC2E716D5F41577C5F7493FDD5AC517A06628C528133540F32C69D89D4E012302EDF169A7167F1B7B10ED
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).\<...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_0b54d5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771562469506502
                                        Encrypted:false
                                        SSDEEP:96:VNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:lHm231Nvu+wIqltWOe3nIP
                                        MD5:80120F22D98CA56E3B581A6F868407AF
                                        SHA1:C892F39EF3F4663AB96E2A8532136737296F981C
                                        SHA-256:A4749B3B9273C0C4309EB52353F96775F206C7CCDA35ACCF4EF06C049EC86FC0
                                        SHA-512:989838792182C51C915CDAF7F99944B4EC657AE6C96F9471CDFB6DD756E2FFCF775355A59790DAC928EE671E9A7BE111ADE64005D8A61F32277ADE272D127BED
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..).U...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_5fa5e3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772839275823038
                                        Encrypted:false
                                        SSDEEP:96:pNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:xHm231Nvu+wIqltWOe3nIP
                                        MD5:A895567FCD9642A984998239014336E1
                                        SHA1:46F2F8D8A7E5BA4C43BAB76C59B31E97ECD097A7
                                        SHA-256:8B0A0E3F015B5284028E49D5F648A713CD84E590A92B264E5EF2B057F9BFC480
                                        SHA-512:8EAB4F177B3DCAA8FE64207BBD7CED21C8C5CC85E6A0F32DFC2AB041EC5200E2FB060E29CBCF60102DB9FB9F9B003AEF058596E0FBAE2371C4D6E559BFD82386
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE_.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._..^.l....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_fcdd4a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76837161257278
                                        Encrypted:false
                                        SSDEEP:96:wNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                        MD5:9A3D720517D8EA32ACC5AD2E4DBA0CC2
                                        SHA1:B6F591E702A734C68CFD706BEF5EEF70054D7155
                                        SHA-256:0025AC75218AA091A3C505338E6D11CC5FE23FCCD14D325AAE8E5382383027D7
                                        SHA-512:F5EB071B5CBA7E27AA249B257CDE5E6320AECB7181ED941309FE2BE97D68B5305248A4584968201E1D318C4D6AA56E5F1B5E47A3E994C8CD96A646590073F4A0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36698
                                        Entropy (8bit):5.28035327558939
                                        Encrypted:false
                                        SSDEEP:192:10OW0rjJZtwQb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC6:LJDb/+vaW1e07s0eF5fyjEDDS25ST
                                        MD5:F351054A1B46BD928E59B13D030E6B4F
                                        SHA1:3EB7234578BAB7419832E0A3DFC86C75ABC894A4
                                        SHA-256:57CB76A47FE436DE2E47EA17A92AF89654703B9EECA92319785DCC005397A8A4
                                        SHA-512:2CC409B551AB6FB01C45F02C90A9F31E43C23E3C64FDAB66FFDAC4D0ED94858F0F0EC9BF5FEB5DC48424592E06F8D2C14B0F80755BC77D6A0A736744649740D8
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpaci

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29612)
                                        Category:dropped
                                        Size (bytes):31432
                                        Entropy (8bit):5.223109584340976
                                        Encrypted:false
                                        SSDEEP:384:LJDlcR8lOXHc11evMbRlzkmm+4F6GpzG8Sc7nfZBhVOi:L0XHcEMbRlz1+F6GpzGcBhr
                                        MD5:4702538DBCFAAADC53257EA73B3C9778
                                        SHA1:FA6B5D67DE133FF4A47C8D48E216E326A199F99A
                                        SHA-256:70B2BF6325B71F6134DD87CDE2982BC5087F0124E377F78F4B3891046870055A
                                        SHA-512:5344D6C05D9498813DF028790E5FD179264BFA9452CA8031A142380F475879380DE8EFD272F983E261D71CD4B93733B013D95D227C03C9E0C5FCDF4EBE81D9C9
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpaci

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1397)
                                        Category:dropped
                                        Size (bytes):18044
                                        Entropy (8bit):5.085323780214413
                                        Encrypted:false
                                        SSDEEP:192:XVjJZtwZ7HnoBp51kF5fyc0aqEc2WpA1OIgmB0iBfT9RhS2wV53skuMaaSQhQz0N:XxJS0eF5fyjEDDS25ST
                                        MD5:EF0D1841B2D27EE513B7F063E3BBD504
                                        SHA1:22BB0182FB7C8080948EEF969F33513E17591B90
                                        SHA-256:F936DFFB4243444117334CEC80EECE47DD8C38AF820AA4ABB2E43133CE69A427
                                        SHA-512:3B83A89A2465452B628D807115DE1831CDB99778AF5107D94EDD73D662C287B5A193B7714FE3A3EC2B8CA23278C003CCCFE85EA5DC82B28B2D88431C8F4B686C
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpacityHover=26&borderColorHover=2293f7&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=e69700&bgTextureActive=diagonals

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_glass_65_ffffff_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.584405453257474
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh3EUyKO0klyjl2XIzgN+E3VKF2EMiVAVTp:6v/7J0U0l3XIzS+E3V+2EMiVw9
                                        MD5:8EF0673B1B97B64B47D4AB54BAE5793D
                                        SHA1:C5C918B8003EC9D14A197DC9F9E0EB52F14E0CAE
                                        SHA-256:3D59D264A71F5FEECC7A8D9E4DA1B0439FBE0C029AB6ED5F5FC4EA785212CBAB
                                        SHA-512:A08439B5B19E25B6AD0298BE84BC924566354A388D0F4F75FEC63EBB87594DA00D15AF608A661B1451324B5B768E69041CCEAA29FCA829FCE2597AAB3B0C4A74
                                        Malicious:false
                                        Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."........IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_100_f6f6f6_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):330
                                        Entropy (8bit):6.145631819865785
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkjwFFRtIs7wJSOQ2zgN+E3VKF2EMiVAVTp:6v/7WdUpsRscO3zS+E3V+2EMiVw9
                                        MD5:45ED73FE52DAF16B2D3A0E72662479E2
                                        SHA1:76FE051E93E4508E1FD918028DE5B68900BAB964
                                        SHA-256:1B789CAD6E5512F4EB6B3543BA96AABD5513DCDF944218BC59BB4E81811C4EAC
                                        SHA-512:BE8236401084C0EDD5D169A208C5C686F7B8E1C24E0C750B8E590D8940DF6576262C839822E613E134608F6B79E615C341F7A25C365E6A97B1FCA7B66B0B330D
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......RIDAT.....0....- ...\........p.$&.....=8.I.D.+...X.L.(.p.(.c.q..]xa.....RO..n..\..........%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_25_0073ea_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.466032240390623
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+wTJ4PMnmAV3XyzS+E3V+2EMiVw9:no19+wTJ4PJAVHyzjE82EMr
                                        MD5:D8B3965B9A0F738201E2ED73842D1CD0
                                        SHA1:88047653F0BA0170C890D7B4BFE154D3B0D0AA37
                                        SHA-256:3F5E8DC44FE61C8CF47056EB6A048CC6C33421F62323D05C41DD1CF785AD1613
                                        SHA-512:6C6DB70787ED33DB38398064ED44AAE9DB86329A62D05FABBC300CE328CAE5ABE48AD57192EE84D9AFFF6BCE9EF857058156B9DE9BE4E5030C4A7F5B96366AA4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..P.CC.:{........^.].....^..]>B..E(....Uz...GBH Xm.j\......W<..k'.A...]"Q{....."5!. 't.....0.h))...>.B.g..H..".s......Y{...p.../.8.p5`.p5....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_50_dddddd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):339
                                        Entropy (8bit):6.224470981713993
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkaWlvnnH9CILkn3Z00g2zgN+E3VKF2EMiVAVTp:6v/7WdUldCVC0g2zS+E3V+2EMiVw9
                                        MD5:274D0A867B4B7383B8F00DF1ABF31C97
                                        SHA1:9EECAD7F83B31AB8D6737EFED4F0EF0D02336198
                                        SHA-256:A59969DE2C0EB56021CB423D2AEAE22655A2CF4B0F08E5D79FA2F207C70AC812
                                        SHA-512:DCA724499AD621A631A7EB2AD2CB372D691CA5F8187321DCC356768175792519ED6BDBAFEE5722305A8FF7528D949F852ABB132EA1C4212770F56CC3317B492A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......[IDAT....@P...'.FI.1...@F`....{X....&.,.....g*..%kE....{.....k&.X.Y...J.G..[8|,k.c.d._../......3J...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_0073ea_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.744729627550153
                                        Encrypted:false
                                        SSDEEP:96:FNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:1Hm231Nvu+wIqltWOe3nIP
                                        MD5:D41835FDF53408D566DF927F3643A838
                                        SHA1:1C5AD08E530026EFEF2F3F16206C2C174ED6A0C6
                                        SHA-256:55131EBC9D75A319E819963134EE159BEE69FB1BB273B66DC6ADA30BB6BA8825
                                        SHA-512:C302E3D192884847D2146F628AC69E77412B35786FE8C4EB27FE307C02C4702C5E99A018D0BD7D7CDB66CEAB8056FBCACCC22B6C32FA76D4751EC86119024074
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_666666_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.928455943008907
                                        Encrypted:false
                                        SSDEEP:192:eMzXuohHXyFN1Ce1gydd84kWORcDrbeq3ek:79HXk1t1gMd8WOkrbeUek
                                        MD5:D779CF92249EF61590F0B6FA32207423
                                        SHA1:5D0223055783B026D13CCF508FD54317B030981E
                                        SHA-256:18257A1FC35E3B8C129E2EE60DA4B617703FE80E43F8D8F3052614BF7AA8CABF
                                        SHA-512:440349B6C97F034C635D731A128EA0A637867EA971631B7A0F4835EB92FD2B7F892B1AFB9CAF78681FE36EACAC8C179793159A29A2052B0F561295C359B31B36
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.f.\._....tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_ff0084_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.741874689095492
                                        Encrypted:false
                                        SSDEEP:96:QNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:iHm231Nvu+wIqltWOe3nIP
                                        MD5:CDA9229A0065C60B446D7F7649A66990
                                        SHA1:FA668D67BE21B2B327BA98A8058ECC1F2C0FDF99
                                        SHA-256:03E5843431B1363AECC079313E1596ECA5B159193151B2B185CD6940FC8F33B3
                                        SHA-512:8C9DB2836B8EE3C4FB7492FEED43A66B997A9C1432264D91EAE7864921DADD297FAA78650507DD5B8473193A67A4F57C8E77D08A3E50177A29FF6FEF4C864E6C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................@......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36444
                                        Entropy (8bit):5.27355053792439
                                        Encrypted:false
                                        SSDEEP:192:10OW0cuqb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHnk76wS:Iuqb/+vaW1e07kF5fyLEZDS254
                                        MD5:0DFBBBD17E074941DCEF6E995E6BBE7A
                                        SHA1:DC4F67554CDA422929570A1DA422FA2349D7F216
                                        SHA-256:CB111613D1BC715D28CE5A7C1D2CB9AF791E4FA451AB133CD2E372DCEBA7BF7A
                                        SHA-512:8F9A2414E8AECF514F93A5352C41520312D4ED602D131FE60348C382026328BCD7653C46C2D7B274B5789053F0928C3A214170AE4E87A0C6B560002F18E01F48
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29381)
                                        Category:dropped
                                        Size (bytes):31161
                                        Entropy (8bit):5.215426726449217
                                        Encrypted:false
                                        SSDEEP:384:IuqlcR8lOXHc11evzjzkmQ+4q6GpEqQSc7nfZBhVM:zFXHcEzjz1Eq6GpEqwBhG
                                        MD5:AC03FA666A7B451F80ED0CC13FAD2A61
                                        SHA1:6776165B37FBE486AA5DF65FC4DA6C0DC5263A83
                                        SHA-256:FA7C7C248D092B5859A3EBCF34BB4ACC5B673E5C9B0D0D38C6FC9DA86F2D5105
                                        SHA-512:631ECBDC098EDB237BA88335B8CD0CAB1EA5777E52663EE8C86FE067AEBC40DBC1CC9B2FA1079B845A6C975CC461547A8ED602A5770299EC02BA1BC7AE30E1A2
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1357)
                                        Category:dropped
                                        Size (bytes):17790
                                        Entropy (8bit):5.06910679770385
                                        Encrypted:false
                                        SSDEEP:192:XOuik76wF5fyQCEcktpBVqYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhWZDjb0:XOu3F5fyLEZDS254
                                        MD5:2DF72AFC330A1550D9F5873B5C1B9E94
                                        SHA1:8E1503CCDF9C9D0C2B3D2C377F68AC0EAEF506A7
                                        SHA-256:6483A696BA691E280265BDA3B149780615B74F6E92168ECA7491A9391EEBF254
                                        SHA-512:DE9929B3298EF51CD5149AF8702DD2714CC18CF23482A1BE8D20F1B4FB7CDF4D520BDBD3194C30984686CC32037C3C854CE895D7B9F528144295395828E3B426
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25&borderColorHover=0073ea&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityA

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_40_db4865_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.412660102227287
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+g6m4MbPANBEsHalgzS+EELEMPS:X9+g6m4MboNB/HalgzjEELEMPS
                                        MD5:4E0C10D138AC4D6E1F5FBF2C3F12C6F0
                                        SHA1:8CDF55C9A9A30B671CE782E68FC3747AD3362158
                                        SHA-256:7B576CBF72A47E77132D59D5B955ABEB5471796D27A3E83E6613C8164740FAF0
                                        SHA-512:30D1ED9641CDD3E88FBF7700931DFEC6DC77BE928D98A13EF0635A6DE7B4427111A7075DB8B4850C41CDFA7A16327648590AA559239B01ADEC13EF1DC627EE40
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....@.DQXEB..E#.k...U...A.=..L..9.7g.R.4l9.g_.+.........>).?|R4...`.....c./....0.1..1.a.c...vH....K.0.1.a.;.h~..%b....0..R4..+._c..Y....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_50_93c3cd_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.370731262783017
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2gUyKfp5EJ4/al/Sdssq/7Swff+Dr+1Zx8uv7/axzgN+E8VLEMlVbEbp:6v/7egU9+HlKdstOPiFxKzS+EELEMPS
                                        MD5:1B1CC1CB76DF40329A52A4BD9CC75EA6
                                        SHA1:330262B70015FABBB8DA025214432A0AEF07A9F7
                                        SHA-256:8EFAFBBCD3D8B327FF15D57967185B635676B417A1BEA6CF9861FFA07D734B50
                                        SHA-512:C0CAE010535E73B04EDE6F7B7F386FD40CFDB1BBDF99A650B4433B468EA95E97A78C2464A5FEF477E70004443147F7B03381CB321D618AFE54F4699CCEAE6FCE
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....@..Q..X.`..dA.Y.e.5!X.....g..p.I^_J..u.M.8.._....NJ.....?8)9.pR4.a...5.K..5.a..Rr~...5.a.kX..._.D.kX...0!%..0/Q....5LH.....`A.1.^...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_50_ff3853_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):388
                                        Entropy (8bit):6.354872721575915
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+GZyyxlpD+jEcd5F3QKzS+EELEMPS:X9+svp0vPbzjEELEMPS
                                        MD5:10AC5210150D17551470BC939DA04A60
                                        SHA1:BA2E3737ECAEA469D9F85EEC6F14C69690D87037
                                        SHA-256:A93394C7BEC90E6F898F8F1F9D33BB1725F3AD1907DFA6224CDCA7F254414BF5
                                        SHA-512:F60D6979A7C6455058B7D4DFA2E01FED81A2285E10624501382858810AD1E250849DED139B5E8189C22450A00CA4BEC1ACDFBFF3454F52BF503FE9C45701F2C7
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.D..j...GfR$..p..t<,;.?..y......me...u....'E....{..h..I..+;.....1.a.c...vH....K.0.1.a.;.hv..%b....0..R4;...1.a.c...)....Y@.J.a....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_75_ccd232_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.349775460966113
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2gUyKfp5EJ4/ah/0jGUq5vJ2r+1Zx8Q8lIzgN+E8VLEMlVbEbp:6v/7egU9+Hhcw2iFDzS+EELEMPS
                                        MD5:720A6733061E091A739F0E3FF957DE8C
                                        SHA1:8E0E34E79B5479713B0081350EFE98B1F0F1E545
                                        SHA-256:05E59552BCBFF8E1E263B554683A04BCC0CE0C9A0E1AF4A10CBA37554EC1A314
                                        SHA-512:6381A5F6B483B0445BFB2E9D40B424B0FAF596BA8A89793DECEF3BD741DECB5CE23299D1C19BF3A3B712145E2309F86944009DE1003F6AAEB79FE29A0DFBE11C
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh...1..@..Q.; A.....0D...N....--...[M.Jk..:.6.c,.y\.....NJ.....?8)9..0.Q....5LH..5.K..5.a..Rr~...5.a.kX..._.D.kX...0!%..0/Q....?..U........%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_dots-medium_80_ffff38_4x4.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 4 x 4, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):283
                                        Entropy (8bit):5.665634854822703
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP7TCUyKfp5EJ4/idkRRb2zgN+E8VLEMlVbEbp:6v/7SU9+5C6zS+EELEMPS
                                        MD5:7D8B6B72638427A0E1C392E20CB32D66
                                        SHA1:387DFE019CCFDB830337C0D7050BB8A5F0F41E1C
                                        SHA-256:6165C234EFBE5BF7BD1FE9A81565617C9D7645004BBC4BD8C12E18A58270E531
                                        SHA-512:D6F5A58FF14B21F1149D41A5339CAC1C80A3D0F81719B283F06340189D5E8AAC19EBCF346D1DFBB9642BF1CF7E1A9E62C8C667D9E0937EF854048ED6A4A4C5DD
                                        Malicious:false
                                        Preview:.PNG........IHDR.............v..j....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c...........`.X"H..T...(.R....,?...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_dots-small_35_35414f_2x2.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):281
                                        Entropy (8bit):5.646173013782732
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP2+UyKfp5EJ4/36uLZrIzgN+E8VLEMlVbEbp:6v/7ZU9+cRIzS+EELEMPS
                                        MD5:8E8F8AEE6EACB637989B7219DE450E22
                                        SHA1:F8C70020AC19E9C72028AF3AE1A89DC6733EE7CF
                                        SHA-256:1652C711D94344091329CD44FD113CFCF64EDE343139425614400CB81199C991
                                        SHA-512:4A89FEC42E9D191E22DB5681B6B8308DA280B20C09807F60068BE36BF06CAA956F45AD34CAD48CC67A3656EC3F453EB37D58B61A7D79CE6A19BEB99C6133232A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c45ut..g``````.P......(.. .L.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_white-lines_85_f7f7ba_40x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):422
                                        Entropy (8bit):6.134023606491844
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPSaCUyKfp5EJ4/alZgmRsZL+wO2zgN+E8VLEMlVbEbp:6v/76aCU9+imM9zS+EELEMPS
                                        MD5:A487D190889A22604DD005EFCBB35C76
                                        SHA1:4795B34872158DFA003B6BB9401F2726BDBA0C78
                                        SHA-256:DD76479A304E49E86F3EEFCEBD619BC73F1CDC8C12D0327C6F44F3BD3E8E28B7
                                        SHA-512:9AED42B04D2B663F01C3AA9EE462A2ECF3E69A79DED157A9261D97D4084CB895E46606B22CEED3A93EEB17D5EE18DAFBFEA23641094670251B43FDCEDD83B69F
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...d.....+.9n....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx...1..0..AJ*..##^.....<w.~...Z....u...<.y._g.gX:..u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K..n..]..!...=...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_88a206_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7631740339012625
                                        Encrypted:false
                                        SSDEEP:96:MNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:WHm231Nvu+wIqltWOe3nIP
                                        MD5:6F8361C3E4351B84BF3449B2701CE861
                                        SHA1:EF8C4855A849C16CEA1650017A6404E70BAC3181
                                        SHA-256:907AADF33361459CCEA40A206C98931326960C582B5CC11C2CE810B479942145
                                        SHA-512:8D0124F13FB863733C33839B3D4F56237ED2714F15E18889305E05F8D8032760C092C5D2D6DEF9312A8B99AF4EEC157A64934F130AD59DC3B5E6FC377CC0E432
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................Y......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_c02669_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772342562166625
                                        Encrypted:false
                                        SSDEEP:96:P6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:8Hm231Nvu+wIqltWOe3nIP
                                        MD5:FE57FF3C330F2C99D0ECA3B4A62193D4
                                        SHA1:5C8737BF0BD8604E8147B08748961E88D16E3A9B
                                        SHA-256:303BCAF3594BCFEFDB6AC4AE0515E861D5F49DF2C0C2FA8B347C405AC1A2E270
                                        SHA-512:AB06288B03703973591848CA0CBD17EBF2C03A222C4F7365EA329870DCA90731C5DF30C21E7D741EE8D62FC1C4B6DB4C5C3FF91E5F0E0E7BBB73BA5D75446914
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.?.7...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_e1e463_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771406934410624
                                        Encrypted:false
                                        SSDEEP:96:dNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:NHm231Nvu+wIqltWOe3nIP
                                        MD5:ED955934AE5EA87AB2F0957D40FA4267
                                        SHA1:2DC74F149F07A61B25EACA2F56652278896CAE30
                                        SHA-256:3EA861761D71742E401F877935F3BB1A18E69F2687019CDC7CC8C2C64427D80F
                                        SHA-512:A25FEC163A11C11AE732C2BD1D0FFC5A5D01669FF29C74826B05AE211D64A1EABB5514B69A2F518748CBFC93C3AE5D1D3FDECB730955313A89C6573CC8BE25A9
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c@#.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_ffeb33_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.765983658404223
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:9D00A6D4BA4F79E2BCEE3E63231D34E5
                                        SHA1:E33289D398EE9D09397CC524818AEB7F591446CE
                                        SHA-256:05B3A820CA3017660904F14267F7A4D63BD6836AE1CD976655C5075C08BC5976
                                        SHA-512:A6671EC92532446B5930534539891A4B54D1A61CCDF8160C98F2480B1D2499FC33EE13133E100590D3B923C96CF74E2AB5D22B710A92727F2AFF0F630A426D34
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36678
                                        Entropy (8bit):5.286597440644566
                                        Encrypted:false
                                        SSDEEP:192:10OW0DJHdb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHif/YA:J9b/+vaW1e07xF5fyNEfDS25k
                                        MD5:36397A5A1B350CC70097C4E07929FA35
                                        SHA1:E847C13C022A0CC51A709EE629582764FEC47DA0
                                        SHA-256:64B283D576CFE63228E63E652B10A4A3A3738E132981FEF6491E155BFBFA5D96
                                        SHA-512:84DFFA8865349E7B0DBC3237CBF17FE2EE8522993ED7C12DDAC39F7896987DFBF5B23BB6197E5E29EBDB4C426772820059E2AEA8EB6C39D53CD642290B44652D
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29631)
                                        Category:dropped
                                        Size (bytes):31446
                                        Entropy (8bit):5.231060034048568
                                        Encrypted:false
                                        SSDEEP:384:J9lcR8lOXHc11evFVz5m6+406GYznPSc7nfZBhV1:yXHcEFVzUa06GYznBBhn
                                        MD5:1B832A993E798FC7FFC284180638122C
                                        SHA1:058805999875DF95CEAE1950FDA6BBEE951383F5
                                        SHA-256:08C88929232369FC82BFA1AC22701C7D8A085926D420506AF825CAD7F180155D
                                        SHA-512:5D23EEF553B5340812841673EB59053CB83EAD062D9768F98A044B62B616E9A6085680DDBEE3EDB3CE4E91E73C2112C1CDCE70640BFBC0C89410DAB184C31874
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1392)
                                        Category:dropped
                                        Size (bytes):18024
                                        Entropy (8bit):5.097226917357615
                                        Encrypted:false
                                        SSDEEP:192:XhJHef/YL+EF5fy3W/EtEc2tyAArYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhp7:XbtF5fyNEfDS25k
                                        MD5:F7093D52EFCAD4980108022C708E38E6
                                        SHA1:63639060CF664EF5D32652EBE81026EFA09F7C2B
                                        SHA-256:957FFCC659BD342D3D119D217B71D3870E2BB3EEF1F0427EA361CC9A882EFC8C
                                        SHA-512:DAE35BE29C8F5F87B416307ED7A506A9CD9A23DEE4BC3992FD078DEF8675208B220FCB9E3A5AA436242D265F589357A36C12E0B18F879BDFEB142B75C67F9C83
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=db4865&bgTextureActive=diagonals_small&bgIm

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_100_f5f0e5_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):412
                                        Entropy (8bit):6.496577555859627
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+eeOG85ePv5yvzS+EELEMPS:krr9+8GweEvzjEELEMPS
                                        MD5:69BF34EF32FD7F228D36E9A129D7FF66
                                        SHA1:3C5010F8A57A1F64A75571891A4A9396BFC98991
                                        SHA-256:14C4D36F86216BED8AB46E05948440540C6C46471EE05820334CA09D07295390
                                        SHA-512:98DDFA6DBE190479041BB39E2C7480F99D35FF42CA9BD09FBDEA47A74963A9134CE44892A96D500D9F42C498122A0B5ABC2A2F91618F7E7CE67CB4F11D36C9D8
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...1..A....MAh......AHD....)......I..t.GP........S...........a...60F.(.me.k_`..I.9.TA...6Eq....n.Z......+..m?b...UW..4.;u3}B..j....D...,..h...i.a....k.@..it....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_25_cb842e_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.5155240134751295
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+J14hJAjIF2lr2zS+EELEMPS:krr9+J14o062zjEELEMPS
                                        MD5:5D7674A2015FB83A6E8F71FCCDC77787
                                        SHA1:F540B9B656AA397EC44C528533C8D2DC86C38657
                                        SHA-256:43D59E2F8DF1DBCB758D5A15F0E41326939BDB34E5BCD343C91CBF90EBF8FA28
                                        SHA-512:0D013077587A14CF075CB4C1B46ACE965C64D9A86AB0AEC2F93D6D3E24C119E7037E6C68F144E701DCAFF5512E611E3CF38B3A40C32FEB4B73575E69AC9E1FB7
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..@......V.....&.A....h..55.N.%.&.j,..)....~.Y|....p..q....:<G....%{a..1.. .J.B.e.......aR.[%;.{.l-DU.b.R.........H;.......!'.s.T...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_70_ede4d4_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):409
                                        Entropy (8bit):6.553771963328409
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh1r+UyKfp5EJ4/XzgB7HolAClIo5syYdKUDSKzgN+E8VLEMlVbEbp:6v/7J1r+U9+9NHolnB5ESKzS+EELEMPS
                                        MD5:1338B2F36305DF419F9D02073EE82260
                                        SHA1:38C3AF97436D91927ED81441940E81987493C876
                                        SHA-256:445572C0E2730CD024D4B4677EABDF8FADF90BD220E6FC9BBBB391DA3E2F4B1E
                                        SHA-512:058DEB7E62A00524EF3AB8EF327E0E45BB4192782E0FCEC3DCFCC4246C85C931635FC95A016FD201DD98710D06A909B2D9FD511D35657109278EFD993F996ECB
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...........FR..b.R^.zO......~....d.(.A.`Q..KwGw.b..b.O.....6>....0...:.{>HCD...w.!.......f...=>5Er.....dQsq.....1......[......M.D6J..A(.......0~..n.3'j.W....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_100_f4f0ec_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):385
                                        Entropy (8bit):6.445561092623
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/3MtXKUh9EuCOm4UwEZY2zgN+E8VLEMlVbEbp:6v/7WogU9+LbvEuCOmdvzS+EELEMPS
                                        MD5:EFCC4A901D32B64E9234EE8331069665
                                        SHA1:B6652C311B7935EDB6955DE30C6A8A9198C599F3
                                        SHA-256:AE37955D964E1F3CD40B6F48287CE5F26C08C3995877017D93A2E34CABDDC427
                                        SHA-512:368F9FC5DA1D715B55CF77E97D60E0B78F398BC21513E1359622D9D597712ECD011BA3F3018AA4A2DA0BEBB455A099356957251F370C169BEEEF488CDF53012E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(...!..@....o..(<.O.'!...._.%X.G....Opm....!.hB....;..X....D.S.M.=.$.......6..g....r9c...i.L..n.....>...T].}.UcBh.....O...k>L. .a...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_65_fee4bd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):372
                                        Entropy (8bit):6.343100446698306
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/6UbEn19st28A04nqJ8qlRVgiFcSuf+vzgN+E8VLEMlVbG:6v/7WogU9+RLn3sXADn6lRVgoxQ+vzSr
                                        MD5:C2DDEA1F78686FF032149F477DE9DF46
                                        SHA1:71EA6516F3C1F906F19D9820C47678A73FFD70E1
                                        SHA-256:ADA10D93CD8D332A65CB059BBDDD09DA62A8D534CC7A5F59CCFD49B630B2AFBA
                                        SHA-512:DC35F8B48D06A4EC8764FD80FDF4759B625D06BD7D89964B2A3B133EEF95294C72B47D4B14EAE829F7B5441F79A03575BAC8C8A3046BCC81399037E80CEA61A6
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......xIDAT(.....A.D.QW.XP.p-@B.G..h...*h....s......MHP.xc.o... ....x..*.].Dv.H^.,FO......&.btSO"..{...L./c%...r......!.B.:.P|v]...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_75_f5f5b5_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):381
                                        Entropy (8bit):6.3424039844238544
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/0DvsNj3jwZcUqa/dTv1c9dR6Oi6zgN+E8VLEMlVbEbp:6v/7WogU9+aNTjszqYL1S99zS+EELEM6
                                        MD5:586F9F3503FCB7F946CD446094936AB9
                                        SHA1:03B3DAA94DAFC7FF7AF1EBAFF98E9FF5467EB34C
                                        SHA-256:DA1919C9B136E3AD109E49415A731B2A4129C78B4AC3ADE387E60BB279644625
                                        SHA-512:6DF64AF4A0C1CE4BAFEB30AD6DE699C44E62BC219559543FA07644E82647419F69D9E8DCE507FFC6A23D39C05ED201C996D7A1099E4CAACAB38C329A19C326DF
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`.F..;.]..xY.7".::..8.X.-.Ckx...|.._Css.M.v..K~O...>a._....10..y..Z..&....Y..1.RKO.y.E|..*f...1..],EO....|..w...)^..;...#[...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_inset-soft_100_f4f0ec_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):461
                                        Entropy (8bit):6.769093155244375
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+w8Elrm+vRBB5E7jL2zS+EELEMPS:no19+glrNfE/qzjEELEMPS
                                        MD5:65A7EE8510678A4E6F1B6E4556FA91DD
                                        SHA1:020587178A4C3F8A02D23DE838F0BD44C56D7C18
                                        SHA-256:F85CD2797BD6CB66C2BAC16DDD8209BFD06688DF884DA7A389FBEE3669613DE5
                                        SHA-512:AFBB0527F0539543548D9ED84CA735328FBCF8532C637FE4ACA357963B82CA643FCD6498FC302BB21493A407E10FD37558F06CE04149591A21EF67D28FFE7A99
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(...K.Q....=t"...h.....%E..Y....l.....`..Xdm.".I4..,......{.w.f..0........4U....`.g......G...a.}.L..e}9}G"...!.E;{Et1..p.f5.+.......-.S../...Pt.5....\......Zt#.P....C5(.y...%.........s...(..+.i..._...{[..';J...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_c47a23_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.765571973013318
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:258CC1658196388E44F44CE2CA342839
                                        SHA1:CFF5E5A39B568471E5265A1B90FA4C26582CE371
                                        SHA-256:8A50E81928F2FF1CFB83CEE554E368412965A658A02074C4D75FE6EFE2938095
                                        SHA-512:D3059387D0ACF67B549BE4AD5D1E78A7FD7F88164FAD7A51A4B1A1FB0E4C2134699DEB5C0B4838BEFB433E6B4FD4EC75255FE7625D3527FFA1F5D5DB35A24988
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.a%2...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_cb672b_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.774920146248026
                                        Encrypted:false
                                        SSDEEP:96:mVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:mlHm231Nvu+wIqltWOe3nIP
                                        MD5:6854089D6E540ED92F49B4697790DEEF
                                        SHA1:03D9D6114763DD07E81209520BFC815466C83E48
                                        SHA-256:C01309AF5216C7C917D49C3570720640D663B8ADED6A8A7A0DE0A25EFB0269F3
                                        SHA-512:30CF018338DA4BADC610B4184D2A086CF186C6318732839485CF6629C3D76FA886A23CD431D33F187A194B85E0797568746B7027E2CA83EA114B94777811EE82
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.(T~...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_f08000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.737504834420342
                                        Encrypted:false
                                        SSDEEP:96:2VNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:sHm231Nvu+wIqltWOe3nIP
                                        MD5:C042A8B4780C14B1C866FAE17E9D68D7
                                        SHA1:084FC7A1BB68B972680A6F4D28F6C257D94CC270
                                        SHA-256:55FC63139CE52570A1FBEA3CBD2013D44D40978B76817EDC7BE50985F09FB31E
                                        SHA-512:249EF041AC3D9A21AE44F47C64D467E3147B44151D32C59F833C83A34308C474DEADC7F6E1D9D062A13BB29F4B22B08863CD776051F12E3609227FABA5322A4A
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................r3.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_f35f07_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772920110125113
                                        Encrypted:false
                                        SSDEEP:96:eNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:wHm231Nvu+wIqltWOe3nIP
                                        MD5:5BE468BBE60C121128DD56D098304C70
                                        SHA1:1D7F99B89E9B9BBA19DE431ADD2A4E09FF12E61A
                                        SHA-256:FEB9D17256C1DA0668B0BA4294129FC70CE41F93280D047D3DAF36FE68F18EF0
                                        SHA-512:58FC62D4E6DDB5CDDBA6C83A2F767E24E11F868C614EDB2DC6966A4FD5783B356EF6E3508DFA3C04DC0A0BAFC63B459B9793366046C83DC22A73EC5D09721B71
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._....P...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_ff7519_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76872546534799
                                        Encrypted:false
                                        SSDEEP:96:MsNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                        MD5:90D4B95F7F5018E66653FF33D32F35A6
                                        SHA1:0AEA94585C167FB945886AE060AF265690E11AA3
                                        SHA-256:5E8091D9C902F959F52E76DB516B55E2AAAC0050073A1815AA3A2DF53EA7E9CD
                                        SHA-512:68A8B2C2430E1AEFEE986C32B2C877A843E2AE9E94DA6A591860917C4316E35DEEE733EC69EB0368910EA5B4FD298234634EAF84EC9947A71AB3495E6FD3363E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u....z...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36663
                                        Entropy (8bit):5.280742395188275
                                        Encrypted:false
                                        SSDEEP:192:10OW0z6inb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHDPGgQ:P6inb/+vaW1e07fxF5fyfEnDS25elak
                                        MD5:674D8DEC33C5F767656EA4CA9D3B1E49
                                        SHA1:25467C7287E18CC3F9B25E7C6A4062F0BEF8418C
                                        SHA-256:9C01DCB690FD699B47F9A5789B94C6C262BDE16F9CE2897344F7D0BB13731F2F
                                        SHA-512:E72BEE17EFA750C379FD467B6F4428E06DA78DEC467D3CDC3B484F86D3157826F5F705FDA5A45B119905C04D9FA533F27E120C3C0F7A065515CDEC16D32E1EB4
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29655)
                                        Category:dropped
                                        Size (bytes):31449
                                        Entropy (8bit):5.225591069957868
                                        Encrypted:false
                                        SSDEEP:384:P6inlcR8lOXHc11evZezYmo+4a6Gb+UoSc7nfZBhVpWGc:CiOXHcEZezJsa6Gb+U4BhI
                                        MD5:A5716D950139D94F9E7242DB8B4E761F
                                        SHA1:45A232921F3E540FC44E6CCBC60FEB3825227013
                                        SHA-256:CB99219FC9221A319DFD8D39EC0842D5669AD23F20EBA2781C9110DE9CB5BF8A
                                        SHA-512:3BE5DB0802811EA6AA0D5503DF0C2826D555EA4400E038E41F6267B15A213BB053B47D8AA38AEB67BCEAF0CA8478683B1EFE0C55910EB3B005DE23F3B0BCB1B0
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1371)
                                        Category:dropped
                                        Size (bytes):18009
                                        Entropy (8bit):5.086710250031702
                                        Encrypted:false
                                        SSDEEP:192:XV6ilPGgBT7pF5fydQKHxrEck1n7HcugmB0iBfT9RhS2wV53skuMaaSQhQz0iIhJ:XV6iVxF5fyfEnDS25elak
                                        MD5:23894B7DE810C64646B893B2ACDCD2AE
                                        SHA1:5F5D705E8DAFB123FFCC66170E7E950D74D22439
                                        SHA-256:0EA261BF9D84D24960C2FA03342951BB2277D1AF7979D09F76F6DECA83D58A65
                                        SHA-512:955BE102E9616D6C9DE3F7DDDBE19AE3C229DFF63F86711C87B5D8C1A3D1329EDE106522B8B17CEB745821EEFB3539205B4B0C0D3ADC49EC1090EA25C36F1F56
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=f5ad66&fcHover=a46313&iconColorHover=f08000&bgColorActive=f4f0ec&bgTextureActive=highlight_hard&bgImgOpacityActive=100

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-small_0_aaaaaa_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 2-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.540970259068032
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPCCXUyKOCll429uzgN+E3VKF2EMiVAVTp:6v/7KCUj9uzS+E3V+2EMiVw9
                                        MD5:CF7E81416128126610509E22CBD9999E
                                        SHA1:1B2CCB53763564EEB7B554591E144AB1A423A4A6
                                        SHA-256:918E530A373F786E040E2AB16A45430DC6203B412B93300C7C3FA657DFC1001C
                                        SHA-512:16B515F1A48FBF362034AE29F78774E55AC2119267AB6E8D270A98110F7AA4A4134D6616D07C7D4D8AF62115B1A1D91F43D32B21D682EEDC839B8094D78032E5
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(......%......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..3.r.....tIME....."........IDAT..cX........T.....J....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-thick_15_444444_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):383
                                        Entropy (8bit):6.464989287779997
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkuhGpY/EfbSO6iZvxxMrzgN+E3VKF2EMiVAVTp:6v/7MCU4GpiEjSiZpxMrzS+E3V+2EMiw
                                        MD5:A0C61FF561D4CB1E68B4D9877848AB0E
                                        SHA1:F2927DD772F61EE4C58B47030F4BD52F73C1B8F8
                                        SHA-256:573A4C7CAC703E66D4B3C08B4FB9332C4477E9DFB6350D048084C429295AAE69
                                        SHA-512:3B3E9747871C3230C755C1C0DB42997AD37FA5A79DA81B6F10BDD9BC6D8E9C24B78D14246EBA331613234F66817ECD3B6EEA78F59016D76E73BB4218037501B3
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATH...1..0...g........DO.R.."B..!o......8.R....I...n....q.......u..p........Hp..p7Hq..8.XN2..|l.....dC.0..@...E......os.)?......)..:...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-thick_95_ffdc2e_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):469
                                        Entropy (8bit):6.686740128366266
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+MMU/UvwitI4Y4CWYYKkslTYYKxMzS+E3V+2EMiVw9:X9+bQU4UmX/k8oxMzjE82EMr
                                        MD5:301317202CED65E4879EFA5D9A95F62F
                                        SHA1:C061EFAFA478E9F724635FB74C2D65851FD0FEB2
                                        SHA-256:21DDACBA4BA0C9F48819307D3F2765E11DA34CFF8C002E85E2865119BD08E765
                                        SHA-512:7BF8D5762185D04B6ADA6EA5E5FE16889D0BA19DC67CE55129A49CA7332E5F1FC90C21B552E1080E41F144EB7DA368EC910E740FD05B7284B8D4CBD5C561A2E2
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATh.....0..a.....'.d.L.:.&{x.`..Jq.B(.NE....9._......:..y{|&u......G..Z.3.Y0....T...ql...d.X.J..l.*W#.@m.s.U0.Z.3.Y0.......B.`/T........J......j#.C..i...I.....J...M.Nm.s.U0.Z.3.Y0.......B.`/.i..`.T..@.|.&.G_..>^...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_glass_55_fbf5d0_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.499591053088131
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+rxpJ7Hp7D53zS+E3V+2EMiVw9:krr9+ND7J7D53zjE82EMr
                                        MD5:EC110959652282C6FE3E62C6FD4CC154
                                        SHA1:56FC65EA1486D038F30962D02608140099740DDE
                                        SHA-256:3C3E23F38BDC19B76BC8DBFDE2953CFE8F099699F6EF2DD1A1B05D4BB3DD92C3
                                        SHA-512:8F7E5B7DB77D5FA4D63DF58B5234ECB06F88FB762ED56DC15181AB6461692EE518E1971F1650A0BD7CE0C1FA68D34E90510E1CFB8ADC28EDC67946DE87FE5E2A
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH...-.........&gc~.!...&E........y....c....A..N....W.\....q.oC.5MQ....c+BR....b....s...-.\$.t.....l..D.d.."...3.6...V.....1 ....8...... .W..h...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-hard_30_285c00_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):382
                                        Entropy (8bit):6.46202797803152
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5E/UzyTtCaqTcAqfB2KzgN+E3VKF2EMiVAVTp:6v/7WogU9+/nzqTcAqfwKzS+E3V+2EMr
                                        MD5:DE474B9583FAEAFB12C9E27B8873B8D0
                                        SHA1:D64D63A0AD8155C89D74300EE71EBCE6A25751C8
                                        SHA-256:AA670F547114F5CD5465E89B7C4A57DDDC8362FCC301E013D6A0DB4162BCCE3F
                                        SHA-512:09E01F82E65920722E640F8D1A6D0A945A4A8C3874B9DF8FCE33DDCD6981A6FCA99BB7F16A785B51F1F1D0E8B543D405BAD53969B7307A1CDF58E56563DBAAF8
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....p....y.... ..[Y....h.hq.4..E.....`..\.`.+,}....mp..s...M|!.v..8.%.T.....|.....z.&.<..X.....'&......H..B..c...x.'....E.7.#...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_33_3a8104_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):403
                                        Entropy (8bit):6.531002278304678
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+nuAcOfqhilRQWGRxzS+E3V+2EMiVw9:no19+nuAcOfc9RxzjE82EMr
                                        MD5:A5D6759D66ECDE0B728C18BFEAF51EC2
                                        SHA1:8FDA4B6D3E9274856AD0AD0F9E5EE11EA5796E66
                                        SHA-256:99E137811F7EAA484BBE02BAF6FF66FB27C19F4097287287D3F7494B761991D3
                                        SHA-512:4EF13AFC3C07D782B9369E2E6E538D5800BB1A5D6BA009C04C6D17A9B1CF68C03C454D0819412BD2CE70C14761E5F2765DCA2BE5FA0C5F298925AB2F3CC50877
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..Q.E_n.Lc%T_c%.".5L.Q.=Hf(|.e(...~%y.*d..HT'.6'.6_l7..33..........A'.5.^.R].`.Gh....j<.Y.#.Y{..j......e;.Ak.CA..<....G..^...|h.=ll+.}.......kE.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_50_4eb305_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):409
                                        Entropy (8bit):6.613438939057223
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+gnuOgMs+hvT2zS+E3V+2EMiVw9:no19+gnudMs+xqzjE82EMr
                                        MD5:C6494494A0005BB61DF5E2917692B256
                                        SHA1:6486952CDF9455DF0AA090AC02A7AB9B9CC46E6A
                                        SHA-256:29F2F668B93749532BF3C747A16CC839860859407388613454F30F7C15B0CF7E
                                        SHA-512:EC2EE8A71DBDC96A281D18A2E4C4D2BA6E8A0B6A0D016A06C773B2E2DFCC680B4CCA5FA7D129EFC72CF103ECB939234771AA1B0263B5576F5A965E1482D24E09
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..@.D?SY(.m...&^ ......7..Fk=...-..r...E..`...a....zh[......r......p...Hm...B...Q{...<.gT..,$.+9&..2J...CK..A..'.-60..=Y...3&.[....GY....q..~./."i..C3...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_60_4ca20b_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):417
                                        Entropy (8bit):6.622137642581435
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+JlHsWxUdlQ3zS+E3V+2EMiVw9:no19+Ji2IlizjE82EMr
                                        MD5:7D6D3976BEEA0358ED75B21FDA5D0422
                                        SHA1:7E04E9D3626E201749C6532A7BB00858D6B06017
                                        SHA-256:4B2CB320917A627DF5FF7746170F0C68F975C81A53644A64C1E1BC0386B21E14
                                        SHA-512:A30B675E713155A282B8557EB08999029CBC45C9EBD3520181FC9F8B5650E23C04D1C17B91B7E73EC02999B1D827284C2BF8398503B2E692B4185DC9FCAB1E07
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..-..@.._F Z.A..@!.KB....].n.........@r.*....~.%..$./..d. wW/ADD.78..v.N...E)..E- ..y.....Y.=$.,.K.....u...].....K...Iz.-C(.5.C.....E).Z......R...mm..~.o..i.u..S...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_inset-soft_10_285c00_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):424
                                        Entropy (8bit):6.705633807193599
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+uxuIiknY8pw1eYORFtZ2zS+E3V+2EMiVw9:no19+uxu9IRdnXtIzjE82EMr
                                        MD5:9FDE0C11BDC11666126B7AD3E6999B9F
                                        SHA1:6250B784AB095051BC0C846ECC5B0147E9712DAB
                                        SHA-256:08F914E7F28C78428BA850B5B404E5475849F8FC3F6811CD8C4B9EF5751B9AFA
                                        SHA-512:76C31F8C6C21B2A27CE79EBF5D498120E6555278F7EA93AF6AD774B4CB44D788691BFC42E4F18A5AF9558EFFADAB1C3AE254295914226FDAF95BCB8901D1E48F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(...!...........Z,......u...T.A.m.P.#...u....`.z...V-../}.h6.S0.?...e`..Y..g....;SL...u>)..#..)U..q$Pf..'....8F.....fJ.*7..J.*......+PV.....L.F..uz.[..:5..~...o'...zn...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_4eb305_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778798081854367
                                        Encrypted:false
                                        SSDEEP:96:EjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjT:LHm231Nvu+wIqltWOe3nIP
                                        MD5:7090419BC38A3AB8127077FEBED202D2
                                        SHA1:0D939387645972A3FA4787F9C4345A2E6BABA60E
                                        SHA-256:0CF6652148C57B54E8D8A925ADD5F37FB72DBB9E6FB3B43442CBCB1F25ED6044
                                        SHA-512:83C8EC99DDC8C528067F0CF3384C54914D502594CF71315D5F027A756370652A42E6F326DF0B0773689884CA3E744A9AA97B36DD8F6C8B6E7C64B2A5EF3252CE
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEN..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..| .....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_72b42d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.769506029578022
                                        Encrypted:false
                                        SSDEEP:96:+NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:QHm231Nvu+wIqltWOe3nIP
                                        MD5:3D61A0B492B7EC8E2BAE60A94F503449
                                        SHA1:63D2E84ACC2D0BB2BFAED6D954940F87A21B1E2D
                                        SHA-256:2C114911DC4BEFA3421BADCA73BEE144AF8F0EF3B31B350013828D57D2D32F4A
                                        SHA-512:28647907CC079F97019BEDF598E7543C01585D0E58EB8CEE7D756A2A493E922AC973913A992ADE3922DC92888517DD0B97127E7283276A0348384B43E3CB8EE0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEr.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-...b...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36838
                                        Entropy (8bit):5.2845268342781635
                                        Encrypted:false
                                        SSDEEP:192:10OW0Rmb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHwPwJiqy:Nmb/+vaW1e075F5fyEli6EDDS25f/
                                        MD5:D20F5D81D352E13A899D5873A103885F
                                        SHA1:F5F7655204CFA0371C00D15CE6AAAE705F35F00E
                                        SHA-256:F9957EC60C4F331637AD78C1B05E4103A10D7E3D7DD8B7DBCCA0198B7D3FA1AC
                                        SHA-512:9DC47C1C7E54B7AD52244429D65A3EDCB0AA0C11BB7AC27899776FBD5B9593B4E322B32F4083FB21BB8CA7392AC290A3BD2B7B0C4411F7AEFEF9A0184CA6AF0B
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highl

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29741)
                                        Category:dropped
                                        Size (bytes):31593
                                        Entropy (8bit):5.22868903333992
                                        Encrypted:false
                                        SSDEEP:384:NmlcR8lOXHc11evNozkmn+4H6GpzdlSc7nfZBhVp0:rXHcENoz1zH6GpzdDBhM
                                        MD5:6FD17EC5CC2A8EAAD538F84F9EEBF7B7
                                        SHA1:1997FD0342613241A1CCD1FD7343128392FC5FFB
                                        SHA-256:8512F873BC5FB880C3937C47DB16B839EB74408A77DB37C3D4E0A57E5FCFF664
                                        SHA-512:EAFD40FFC636A6B82A33F8BCA43C50B75251ADF494C8831201B488DA3D79658A5222DFAB5117BE6096D912A00B94A7C86004F68D88AD8B186D679253845E6DFE
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highl

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1429)
                                        Category:dropped
                                        Size (bytes):18184
                                        Entropy (8bit):5.095147589965305
                                        Encrypted:false
                                        SSDEEP:192:XXfPwJiqn/F5fyHoEc7li6Ecf1pAyNYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhM:XXyF5fyEli6EDDS25f/
                                        MD5:09E7BB15E9BE70C1B54840B55A4C6000
                                        SHA1:84D8BFAC5B5A6CAB84014ECBA9AAC663DF256446
                                        SHA-256:5850627DD750D41AA653DAFFB190B61085BF3DEBC944256BD4CD49B6EC729279
                                        SHA-512:0A268A8A5163814B9C9E5BAE5D9CBEEB79B467A467F6E324BAF51F654295CFA8F6F2DE7CBD1CCE77A792A16F09457781A85719C574F79142A32396B5DC80EC68
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highlight_soft&bgImgOpacityHover=50&borderColorHover=8bd83b&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=285c00&bgTex

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_glass_15_5f391b_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.508024514807776
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+znd9Laf+pdT56W7Br2zS+EELEMPS:krr9+zbuf+pdN6gUzjEELEMPS
                                        MD5:34F6ABF331A51AF91C7323BA6391CEEB
                                        SHA1:D13053BA8DAEB3E18F71F54B7DC0AFCC9678D80D
                                        SHA-256:C40803C74B76AF9E74BC1DDAA9BEB1AB7104865EF7BD1052270385A01D3A1734
                                        SHA-512:F39F1CF6D785D5659800EDAF9099E3796A4D8860C9477EE6A05F091F1CD61E1F19F2D0EE70BD0CDB175616A3BD46EBB768AAA160D3D74475443EA85548D136FA
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..a...7..,&..v.Z5h.d0.....-F.`.+x...F...T......K..a`.f..$).. .:..}...6..[....q.....&AAM........#.k..b.3..>c...#..?N.A.........][J...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_20_1c160d_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5851
                                        Entropy (8bit):7.6946038920456905
                                        Encrypted:false
                                        SSDEEP:96:fHkz7tzQ5Wx+dqQw+OTN80eCadVnm23KCanUUTJSqgk5iEatVIQoz+4FQ:P4tz9odJwh53ZyN37DNfk5iEA6z+4FQ
                                        MD5:861A9CB5CE63EAED1C371AAFCE1C7409
                                        SHA1:68392BA0330C55346192FF876F308314E3CC5A3E
                                        SHA-256:3D1985675857F2BBABE7D681C5CDAE2A7074435D96E6295A0D5863F12E752F91
                                        SHA-512:69DA4D565FED81E3B9EA9F5F383481DFF036074DAC37D602C2998E4CE5AF5683EF62FC38FB89DE4C578A25F27F4D0F293700B8A37213951B19F5B19023C89FBE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O.e.U........Effb..{fP..6V`C0.B.`I.N"GN..@..9.8N...b6cX .;.e..A...Yr..Hx....D.A$&.`....e.:..3.SU..w.....:u..[..{.............1.U;........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6........Z.....v.qD?.kc.^c.>....:m..P._.F..e.yu.-.d....^.....Z.3.W......M...fS=e..k9w.[.z_.7.!.2J.V^=k..(y.!..^..7..kb..5z.U..ZSf_.......R..x..#...f.7N.ja......0..[e..n.s..:...5{....M9..]....k[...W.....qrQo..Y...;.u..k...>.l..l..._.y...V..5*W....v..W?R3C..n].3Uv.......B.'^......n...m ........<.uc........Nx........`......0..a/...6..3{.G.,[.{.[....vlr..G....i....].YWR....2..C..T..R'..^j...p3h.,+..9b...-S5..G..J7.*r.5P....*.]Y{.N.z#*...Z._....ul...8Y.R....r.UY^..y[...j2[.cNI%.I..k.........f8.<...p9wd.s.[.}.~...}D.f..B.E.......6....[...s

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_25_453326_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5910
                                        Entropy (8bit):7.684608225622468
                                        Encrypted:false
                                        SSDEEP:96:fH75LcyckRWaCXCdsD4nMoAAzge7VBdPF/gN2avx49q371JizscvHFpKbK:P1cyckRW5XCO4Mozo2UQqpJuzPFeK
                                        MD5:723B73CFFAF084B588D04A934E55F1D4
                                        SHA1:27021E05AE990916B9E8750AFE9BA3F478B9DDCD
                                        SHA-256:2AC203B05A8B8942CEC8F277E538F77244F432106C4B6B47F1777F4EE9D82D9D
                                        SHA-512:7A325550CF751531A2BFBBB6C62BBC16DF18F482A005D6650E4DC97371D70EE582467B7664BA2F44C74B4D3F25E5F8D1764DF048108B3D6F9494ABC99A06736C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O.]GV......@Jd!....q.V.=..!pB...6Q.c.....x.H..3.HHx.AL..;h......O$X...g....;..2...p..k....*.NU...o.<.[u..9U...w.......x..........Y.......pw........l......V.6......+..w........;.............`.`.........q.....X.........l......V.6......+..w........;.............`.`.........q.....X..q..=.s.#..X...%...c.bQ...<T..7z.bV...J.o.o..J/}^..Z.3k.W......M...fS9y..j9v.Z.z_.5.!.2J.VV=K..(y..!..V..7..kb..%z.U..Z.g_.(m..+WU..d....G......>.Jf......0.....t.n{..S..'1k.Q....7.H....>N.....Z.QZ.s4N....7k..Z....k.a..).S.f^..F/..%...uu.[.b5\...N...GJfh...z..V%...Q.jn....r.p...O.. ........,..^..;.................l......V....g...<p&.H.E.n.n..X...4.Q.#..<.bZ..L...+..HG.G.].!.m_..R'..VJ...p3h.,+..9....j.=..U..nJU.)k.R-..........k.(...k.~..zZ.!...d.J.......Wyy.FgmY..+.l^.1%.\.z....o~.........(.....C....m.......l..".yl...q..Ht.....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_30_44372c_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5972
                                        Entropy (8bit):7.698212690009269
                                        Encrypted:false
                                        SSDEEP:96:fHsT+egenQUpb/nSSzb9W62p3VrrZrKmZTmiXJ5Rhqxwdju16tAQZgKzrayOFGg:PU+eBnQUhSkaprrKETJDRkkuBFqIGg
                                        MD5:7D2C0D67EB9BCF602B3F7512CBEFC48F
                                        SHA1:25E1FD526BFA0B8705AFC714509BF134F700B122
                                        SHA-256:AC21BFA995A4F3C39DDEE38115D21C3BB66CE057ED3FDD70268445DEA9C9790F
                                        SHA-512:44DAB62CB87F6191F839726A6DCF64F4E4F011BBE8C729965A1823C60815A7BA2BA7502CD2D482F769D40E5610E755E5B2C9E5DB216FEB858AC36CC35ADDEA37
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......XIDATx..O.'.U.{~.N....N..B...D..xgw.F.....^.%;.....K.#...n..A.XP.!..H$'..'rd...Q"$.8!$...\...-...gk...UU...?..=[]...{U.S..5...O..Y........].......pkxp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.n..>.{a..-z{..={.e.=e!.u.'.b?O.......`[(.7.%.+..ua..g....YE1%F=.J..r.V..r......o,S.}e.r..z...}.Q...C...xko.%..r.J..p.&...m..<V...K....#..<..._..72C........9*3..a..@]OR..Y....7.%...y_L.m..^e..v....r.......Y....*.S.f^..f/Y.%....uu..R5\.m.n~......t......U...Fd....<.Z...?...?]A&.......Y8.....v......,x..........;......0...^.m..3ag|ah...=..=.vR}b;...Y....<.RZ...g.u.Tr.....2..C..X..R'..^J...t+h.,+..5b....S5.G.[K7.*R.=P......]^...z#...^......}l...b..%.klA..J.Wyy.F..Y.,W...SJ*.8a.o}...ca3l.....~.M..$>.:.?f..lA......G..<5...=.M*

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_highlight-soft_20_201913_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):433
                                        Entropy (8bit):6.628713451990196
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+cDz1FZE2zqyr2avzS+EELEMPS:no19+cP5znvzjEELEMPS
                                        MD5:990000B89E984CF1855C16FB555A20E7
                                        SHA1:589223D8D62039EFF98959DCB400DBFA3F8C6E35
                                        SHA-256:0FF5041D63B8CBA449F5BC98C2821C5909220006D1C5B69F7E0F3AF6200AC309
                                        SHA-512:BC267087DA14BDC31C057BE5F354291415334849290DD2917C1AD9230570011320D958D6A87611B397F377FFB2E3CACF8D67367BC422FE11D77699B1C682EE0D
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`.... .CE......4....dc.s......a..vm'..;`32....[ 1=.;..........7... th...4i..\y.Yt.J.3.J.3.B'.m..+...on.y..F..FkVO.".Lm\.D..TO..#*.;.^.~.n..$..R.mZ4^.,.q......o...<.<.Y.g".....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_highlight-soft_20_619226_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):6.461550350745626
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EJ4/fIiRW7JBNsr4BMkGWkq/lkCzOzgN+E8VLEMlVbEbp:6v/7WogU9+k0PNsZuCCzOzS+EELEMPS
                                        MD5:AB79BC5BE3BC772DC46252B64FA824D1
                                        SHA1:567C105D0754702CA33ABD453B8EFC21A45B9D53
                                        SHA-256:9F503974690E4F4D59D9813C37C3B299225712742898004D29DF20FB73AE561F
                                        SHA-512:65DCAB4C036D93DC47F62181938F143ECC3489FC62A82F422E67B3AD63AB43FF2B585CB20DB1A143A947B0EF7B14793697EA45D1FE717C6B64C85879B9FE7CBD
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(....P....IE..E-...H..U.+.. ...h6h..,..x.....$./....4.....%I...t..TSXCj..QRq3..&gBk....d........h2=-...):..en=.d.........c....%;..F.-.......W...O...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_inset-soft_10_201913_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):438
                                        Entropy (8bit):6.6438218171907995
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+dynbgqGK3/RdPBp/7ayzS+EELEMPS:no19+AnJG0JBz7zjEELEMPS
                                        MD5:479B880D56FFDE90B540CD1A04A756E8
                                        SHA1:F1532AC398311E8084B8EBD88DC39D8741E493B9
                                        SHA-256:EDBECA747559B65BE63840BBBD28D3D08052FBF30138F5D9E68DF5AE53651C5E
                                        SHA-512:D3012A1896963953DAB12AFE05A8F48B8498B27A7FFC3D6F63E06AB03E64FD072EB2F83022FCFD5F722AFAD868C15048AB86F638D1679BDF2C022E02DAD8FA11
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`...s~...V...3....4..Dbv.VWa"R.^...J>.. &..,.........or...1.lV......t.}.0..[A..wc%..p.%#./.{.!.1d$T..Q.n....p.*&...Z..p'T...k.iK..s........n.Y.N.#......ej#g.o\..-A..._..]../}.W.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_9bcc60_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767895128988182
                                        Encrypted:false
                                        SSDEEP:96:2NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:IHm231Nvu+wIqltWOe3nIP
                                        MD5:0285460263EDD66D2D4101BDEC175D58
                                        SHA1:1801FB66888A8D3434C1DC3E68C5C0A2B2474E74
                                        SHA-256:B4D97785B31A6143AF7DDEB2D8C4B07ED0953F14CE21D6A2DE42EE17DF9BC49A
                                        SHA-512:FF1CA551559AED3B3B9CC56CD3990FDDBB8108BC1D14D4815A0C9D7827E7AF949CAC0EB3BC9CFDF8D9F828D6DC36939DCF5B056AF6CFB9704B8359E93D61CCF5
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`ocq....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_add978_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.780780761491566
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:FDB7A923A84D2AE91457941A8716162B
                                        SHA1:3963DCE734F1B6488518EF65BDE848A9530E5B71
                                        SHA-256:A1AE8A59E432E0DFE23FA3A89C79A623FD915ADECC6EACED365E3A07A36FD72D
                                        SHA-512:3381E62F79697E7DB3DE45C21A5DD1EA50B066630BFCFD955DAFE2FE57538D23BA2692E01BC615E0B0704FA60F913EA909AE04B2077E4A217E28A89870E1B4F6
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x.Y.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_e3ddc9_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.775828967093814
                                        Encrypted:false
                                        SSDEEP:96:4NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:KHm231Nvu+wIqltWOe3nIP
                                        MD5:C4DB516F01FE004D3FAD7BF6E17425CA
                                        SHA1:46642C9DF69A8BF7C1E0F715C2FFD8967AC6AEF4
                                        SHA-256:0CE7A500EE361A1EC37075FE73F5E2DF0B6A11DBFA1F7D22D28C43FCFEC7A467
                                        SHA-512:F51A97EB5146E9297E24EE26C2F565EAD50AA0A066F48BD1F498DBA79112A7C6E08FEE75917ACE908007394E56CAEE8FE83829354A9AF9A1CE80F234C911E75B
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................t.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_f1fd86_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767179218098146
                                        Encrypted:false
                                        SSDEEP:96:yNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:MHm231Nvu+wIqltWOe3nIP
                                        MD5:C0BDD404E4D2A5D3C93201085ADFD0B2
                                        SHA1:1FC7A4CAFD0C65C1F734AAC20FAD5F41BF92C961
                                        SHA-256:C131DC62CD1046372FFFDA53AC05CD438CFD4AA530D7B043F20E78F5E2732004
                                        SHA-512:F10E3B644C5997767D6B4E4935B3DBC98E3BA3B5CDE69159E8F9231D2BC4DF5113F491BCA0B5087B865B802EF28ABE28A83ECAFCCFAD93C69C6AAA18865E6C2F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................!......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36696
                                        Entropy (8bit):5.283245047820083
                                        Encrypted:false
                                        SSDEEP:384:iPQnb/+vaW1e073DX9F5fyd9EZDS25ulak:pbGP73DEQDS2G
                                        MD5:6FF4CE9688B7C01F7C6024120887AD65
                                        SHA1:AA741D08DB2E2177B9AB068A038A162D3A9CD518
                                        SHA-256:89237CD26E36F6874167B688F6CBEB6791E9114F91D3B0DC1F4057B86BA478D2
                                        SHA-512:7F4F684205E59419A17918EF1B7A17224BFBB2272C7235AD3DE282039B05ABC0917B07BCFBFA16A87D784EDF1352EB9E6C0CE2913A0D17B621400A77377F0E07
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29661)
                                        Category:dropped
                                        Size (bytes):31467
                                        Entropy (8bit):5.22786442951504
                                        Encrypted:false
                                        SSDEEP:384:iPQnlcR8lOXHc11evaL5mqAnztm8HS1E+4u6GyzqYSc7nfZBhVFWGc:pOXHcEacqYz48Vu6GyzqIBhM
                                        MD5:6152D14CF3B1E5E829032012406AD201
                                        SHA1:7B1FF6FA9E7DDCC93242F7915DEC41B9B096AD58
                                        SHA-256:E01DB16A25EEDA85CBA119C390B95AD68CEEDF00438DCBC63CDCE78F104F3C52
                                        SHA-512:D91D7C3FF083A9EA1FFFD941CCEDED61F778EACD387D77E7B78C06038537217BF450ABC37FF8E63B956E0FD109106C4EFCF4383F2F7399DD5BBF79CAFA2E6683
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1383)
                                        Category:dropped
                                        Size (bytes):18042
                                        Entropy (8bit):5.090247985518859
                                        Encrypted:false
                                        SSDEEP:192:XQJrHDQ1PVPgqMp8MCV9F5fydVPd1EcIVggtHBgmB0iBfT9RhS2wV53skuMaaSQ3:XgPQVDX9F5fyd9EZDS25ulak
                                        MD5:F7BBF6EB933B16269E354E9F219F05CF
                                        SHA1:81997C38A9916E00E235A64E8B2385EAAA5D6F3E
                                        SHA-256:5958C3E54F27C21BF2C6F52B4A2DF5D0D17BB6104EC8076A0F12D78E9B06E279
                                        SHA-512:D3BB37E1084F699D1F51AFD547A78D167F311AE5D2F3ADB7AFB7766892BDB9EBC1B01A75C947A1279A482C870F77DDB654034D31699564228193BA03B2009EC5
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHover=30&borderColorHover=9c947c&fcHover=baec7e&iconColorHover=add978&bgColorActive=201913&bgTextureActive=highlight_sof

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_100_f8f8f8_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):324
                                        Entropy (8bit):6.099280043808392
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOku2PPbN1MFwLKUp09SAG2zgN+E3VKF2EMiVAVTp:6v/7JSUAoPhOWAvzS+E3V+2EMiVw9
                                        MD5:43482996F3298BDE3B0C5DA39449BFB2
                                        SHA1:859318FDE99F3D8E3B8D867EA90AC5B46CC96851
                                        SHA-256:E625FD94AF14EBEA9BD79F5F72C4D099B9372199168D0CC09B0C12F731B0A195
                                        SHA-512:3AE92C757E5A61D4973BF096408F54BE091166DC2E4126BBC4C0D766537E16B1B96367A8FB1F6413C16F39ABED00C1B278A63E3318A656E75976C70B2ECDE4D8
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......LIDAT8.c.}...a.."."..?.~.01801.1.|....!..7..C2....d..B...g........;x.....V..58.f....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_35_dddddd_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):6.118633877079006
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkKhOp1idiimfIazgN+E3VKF2EMiVAVTp:6v/7JSUUOp1PhAazS+E3V+2EMiVw9
                                        MD5:849013BB9DD833BA0E53560AE101A82A
                                        SHA1:EEC1D9611C6C3790C8F79008A69DE45B841D77E5
                                        SHA-256:73E0C96909304F28CE03CD13929F0D99CF89F939DA3F6F788A6A3FD54C57BE76
                                        SHA-512:EFB376A3BCCFF2A5F11D9BEDBD52AE36C43861A647326738FF5F5018115DFDEBB567BAD12E6C7341E6D87A6D0DE299673EC8DD28BCD663B6813D0D1065AE004D
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......KIDAT8.cx....a.."*....x..r..}dblax ..0..q...?L.s...0<>.......'...y....h( .yA..Rw.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_60_eeeeee_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):6.136900547450183
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkKh2vC4mwO3DW2zgN+E3VKF2EMiVAVTp:6v/7JSUU2vCVzzS+E3V+2EMiVw9
                                        MD5:6DBC2DF754AFE0B05C9A1C50AA797C13
                                        SHA1:5703D4E46789D62A9B8F858A728254A91D320911
                                        SHA-256:897B58BC1EC9CAABC0AB95CCEA0EE26FCA10BF9AA7A53D6FC0CBC56A4164D42A
                                        SHA-512:BD2A5DF70345FEDADE86C361CF3D9670365877BAD81F612ECFB201FED93B068AE4009153A5A373EFA408324E2E7A0AD7CB9FFA79D0D5420F3ED301E127C3772E
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......KIDAT8.c.....0.F.........b...b....."..p....'0|......./.c!..._9.......h( .m[._.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_inset-hard_75_999999_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):310
                                        Entropy (8bit):5.999011311090708
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkiAFl4BK7yRTh4Dag2zgN+E3VKF2EMiVAVTp:6v/7WdUMAfgK7yRTh4Dag2zS+E3V+2Ek
                                        MD5:6767DB53D8EF6F2FBC454B9AF8540601
                                        SHA1:3708375F44492D32A6376BAB4AAAE15E1AD3574E
                                        SHA-256:E2E788B2F4D440B4E4A8B306B81B8AA519994095A3FE7DF78BE1FD139F55D785
                                        SHA-512:568999EB273ED5C9794C539834F964F46CEC0C046810BDB396D07CA15AAEA5445240565BBF5D48AB7DCBD5129F5161DF08677F90EF614CE860973733E3D38E47
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......>IDAT....Q.. .D......5..{.T.2.r.@........JE..u.q....D....E|...zv.;..]n...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_inset-soft_50_c9c9c9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):329
                                        Entropy (8bit):6.159377583111018
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkjPE+qfyznFF39vzgN+E3VKF2EMiVAVTp:6v/7WdUjnnF19vzS+E3V+2EMiVw9
                                        MD5:06F61468D4C682CF8C40D0B2DE2472C7
                                        SHA1:BC120A19F11521F55AB011EFC54519484296A801
                                        SHA-256:BAD2807409F8E9A151F6316BE68E110504D0C87A3E7D27C692C919C7F382E3CB
                                        SHA-512:1E203FD7BEB683DC5D098362B0DC9B833B1786EA56DBD8045F708E3585662EAE9EE7B7979F11A2FBA86F7D47F2AE22AA45B07D115F1E63467D5FB6CD3BA7D46B
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......QIDAT......0....n.TWd...s..%..Z.....0.$'>y...$4..e.Z...........m7.x.~.v.....)...<......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_3383bb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7748572558304305
                                        Encrypted:false
                                        SSDEEP:96:hNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:pHm231Nvu+wIqltWOe3nIP
                                        MD5:0787C6BF54A66814873CEE2CCAFA9732
                                        SHA1:D78AA4DD126A140219E5E74F7A1FC188DAE39B8F
                                        SHA-256:77D68A1D57B4D4FD319BBB155BF72FCE8394C9DE6DFB1248FF7BA557580978BE
                                        SHA-512:ED22D62D27DB114053855A9E4FE6EF0AA5B8B1B7F02FA51D4B9EC2F0A213D875291D70CF378F2B062D9F856E651264C7E7F8A60EAEEB2C3C67FC7603D6A32D3C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....]....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_70b2e1_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7666744210772265
                                        Encrypted:false
                                        SSDEEP:96:BNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:JHm231Nvu+wIqltWOe3nIP
                                        MD5:2BE9B4C61F3F58F52921F7559DADC676
                                        SHA1:C9F6E9C405B4A057B9FDEE94ABC8B30194FFAC84
                                        SHA-256:2C9608B1927D4286185C91E19768EFA3C74116775422FCF75BEE20414B9E3DED
                                        SHA-512:9CD07A4EE9D87F43235591399FF2973FAFB84D4741FAB2CD3016057A3EA56194172AE27EB1C8D679FF406CBB14A7840395AC696B2DC3BD0183ED229BDA978884
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEp..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..ni...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_999999_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.930568719726226
                                        Encrypted:false
                                        SSDEEP:96:gbwMxnYMuizXrKo/5WqxtAqeHLyq/SFR5Xi34CbgAXHs43bxpMhk+3Amt4Aw+eZH:DMzXuohHkyEW/tCEAXHBg3Uqex
                                        MD5:CC407B338A9351A370F4895DBA384B24
                                        SHA1:42206A8D67AFB9435BFFD1579663EBE1A18AEB29
                                        SHA-256:33F6E407E7B5858DF77AAAC1848B0451FBE494AF507233AFFE381351AFA0421F
                                        SHA-512:9AC2F60405850ABC8CC8AF860C20C6CCF1DEF1E44E91D2D895EE4B14F6D8285E5D3E69F26C0B4E2044C01B2BA9E5142E9C733A8646DA521A75CC422F2418CEC3
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..#^......tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_fbc856_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.777593739887738
                                        Encrypted:false
                                        SSDEEP:96:yhNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:ypHm231Nvu+wIqltWOe3nIP
                                        MD5:908D7C74656F60D6716E090009B7D21D
                                        SHA1:6D1A63B435DEFFE5B9AC3C74586BAEAE94F2061D
                                        SHA-256:A70457FDC19FA40C6DF794C8184AB93299DD41B0CC2C5210C7CCDFF9969B5231
                                        SHA-512:4FF4F94B1648934F3813913AEC11D86F9F94A219F7D6F682CDEEE4C0FA41BB5016AC4327BD3B32B2973C3F69005A1ADBFF1EDE3754CE6A40CED179FC005D17F8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..@....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36520
                                        Entropy (8bit):5.277612528633452
                                        Encrypted:false
                                        SSDEEP:192:10OW0O5tb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHQPkvvr:K5tb/+vaW1e07GF5fyqEEDS25Y
                                        MD5:66A05DBB5BAC293CE476E43E7F69A538
                                        SHA1:5B623FE7B333AEF8731B6503A5829924483E3BC4
                                        SHA-256:0D3BA52CCB0BE4E696E0CD7D65C04A51C8476FF8CDF1C988867313CF670B26B6
                                        SHA-512:079907953FC4D5F085D00D6D39E17C4C37DE4AB2C262AB4972D1056CA6C78351647040D101487F0E37EA526FBD60DDB2762D311FD00BD2A77CE8C4C34872C35C
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29453)
                                        Category:dropped
                                        Size (bytes):31234
                                        Entropy (8bit):5.219784610390886
                                        Encrypted:false
                                        SSDEEP:384:K5tlcR8lOXHc11evFi1kzqms+4C6GkEtBSc7nfZBhVk:aEXHcE+kzfoC6GkEtfBhm
                                        MD5:CBEAE3A1C196A22080B7FACE12BE6A22
                                        SHA1:F9D0A0CEF0F6F3A1D69C4F06B7E192D1406B7DAE
                                        SHA-256:592C4AB8112A3C45430AE013B3CDD99BDB74EF03FE18C958DF71CCD2ACEA77F5
                                        SHA-512:BA1459D043FC2D60A73D38621AB5CB488BAA8383BE8CF556012A04B1A45733B7F6D1F96BB7293ABF78C44F41CF83C5E398C65FB4D2106E5E0047614C8680D053
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1358)
                                        Category:dropped
                                        Size (bytes):17866
                                        Entropy (8bit):5.078458550790552
                                        Encrypted:false
                                        SSDEEP:192:X45UPkvvLGF5fyg53EcO32B+yjgmB0iBfT9RhS2wV53skuMaaSQhQz0iIh20:X45aF5fyqEEDS25Y
                                        MD5:1DD5554BA234E75BF2BA13CBA7DE2FFD
                                        SHA1:77D8E0898C772D0F478C912C12FDB10299C26E23
                                        SHA-256:92F063EF8E21FEE9BD792812BC72407F4D55F81AEBAD6668B7BEE9B0C8C786B5
                                        SHA-512:26DD2069EAC13D9F4262EE6998944EFF6152C7DB06B69F8198A4301B39723CB7BEC4FED3A36B906A0451912A737B97EF53F86F1E08F465B49AF59AA818DE6383
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=bbbbbb&fcHover=599fcf&iconColorHover=3383bb&bgColorActive=999999&bgTextureActive=inset_hard&bgImgOpacity

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_diagonal-maze_20_6e4f1c_10x10.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 10, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):354
                                        Entropy (8bit):6.1856798088703915
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPIMUyKfp5EjkIEFFU8agLyACE1jAtyfzgN+E3VKF2EMiVAVTp:6v/7AMU9+mU8aEyaAtyfzS+E3V+2EMiw
                                        MD5:8E54CFD7DE41844B11EBA7D8C6A0D190
                                        SHA1:E42F0848BD4702483EC12830B17F16D52AEE446C
                                        SHA-256:21CD36B1BA6C9F13E4FCCEAA0181DD9F93859C49CB99402F82EBF622AB5500C9
                                        SHA-512:314F99E71C85952B876E0014E654F849D6D13F7CAC753607B2755BDB4B9579008867CF93559B4E39E5AA96EFAFA16B6E45CCA03C41A195A700A1425DB95E67BA
                                        Malicious:false
                                        Preview:.PNG........IHDR.............R.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......fIDAT(.c......a`````..+.W....w......8D..<m..&d......6...2.....ga...F.t6...........G...W.c.A .p.<."5..*..m.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_diagonal-maze_40_000000_10x10.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 10, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):301
                                        Entropy (8bit):5.8094407899272555
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPEpFMUyKOkYmF+v6ZOatLzgN+E3VKF2EMiVAVTp:6v/7YFMUOmF+6TzS+E3V+2EMiVw9
                                        MD5:FEBF32D7E54EEB847E50A642AC71164F
                                        SHA1:655D6D8E685ABF751B93F90E7DA27A11ADAE8CA2
                                        SHA-256:8D123AB9E67782510FA4B8E6880C4475E925298603EC85FFCB2E2B1D0D13D57E
                                        SHA-512:E2C3F9D7642CA4807A7944496B6003D0E2891C2AE8B13CD1911F9571DC56D6F55C45C52D494BDF9E00A8E0CDFCD96B00C0AB642664A2DEFB47EF1570B950CCFC
                                        Malicious:false
                                        Preview:.PNG........IHDR...............L"....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......5IDAT..c````0Nc`@..i..`..,TU...i.!&4-.gg..n...P..E...c..&.A.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_10_eceadf_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):10817
                                        Entropy (8bit):7.975179355860076
                                        Encrypted:false
                                        SSDEEP:192:5m0I5zL5Wt7yuMsf0OoCB+05Sn8erfrZanjySFjhGp89G:olv89yPs/U8oTZPyhhQ
                                        MD5:DAA0366C4F4C1E13878D2E6229FBED41
                                        SHA1:45C336830C04472C6746F5B8BB8142249E209C3E
                                        SHA-256:B3499F4966F2118AED9858D3119598000A0656738D0212ED26585692A5734799
                                        SHA-512:753D2A3E627D9622209744835D277C5407542C88AD30E330D727059E23CB37401541E09D21A2A6EF28C2DDBA3A7B25F0EE4608AD555380D6CAAC4E652488D4F5
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......)EIDATx.}\y......vE..E...T..B.....&.3.3.R"./..,v..64(N.2..d.t..d.j.z.z....n..o..........g.{....G...?<oxx$...........3U.j...>.....!...{.L...E6.............[.0._4._...B.P%tt..n..f..k.p;.VRA.....X.2(..O.J..9....].CS......j-...........*T......[...cA...&......~5..m.;....=b.j..U....o...UL.3....D[V..?..:G......IY......[..."...{.......kx-.A.Eo..=H.T.l8.~.)q..#u.m.zT.....A;.f..J..8.a..vn.)o.~.....,[Y7.5.g..{...|a>....._.^...)n..C.p..o....}zg............V.N]..."f.).;..>cg.b.>.vf]....GB..%.....ei.B[.K.I..I_.7.3d.."....hvS.........H.[......W.#.W..u..E...._...iYE....v...4......c.hs.<].7....W...u............w.T4..7.?.;Egq.....Yhn.W.jv)..-..=jn1%..Jx5d....8.M..B..(....P;.V....#B6n....ri/..T=...@..*8.q....T@.. ...B.........qw.=.6..GT#u...>...oqJ......7.mS...CW....v....d.zIM.M..9Y.a.YD..*.A.Q...\..un..d....-<.T3W..X.&K....v..H..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_10_f8f7f6_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):9962
                                        Entropy (8bit):7.969618322180041
                                        Encrypted:false
                                        SSDEEP:192:5vfrOe0KqRDuvFYV/XAberk2b5wtdT79tYGd/gogGVnP:x6e0LavCV/XSCkVd31/i8P
                                        MD5:9224F99A2486AA6685BAAE76771E1EA9
                                        SHA1:BC890EB71B1B0BA6A2E83C68E9AB531943E7579E
                                        SHA-256:C38192FDF2C50DCC11C75619E36D7A70B2E42A80988A5BA3540C7A86594D5D99
                                        SHA-512:92A60B05866D1E66F1E8E0BD4ED14DEC5450564C6ABD9CF105FCB20EAE2EAC38DE12E1296943CC3C97FBEFD43B50177F6387FFCE0BFDFCE38724BCF85683B0CE
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......%.IDATx.|i............J....T.82.pe.d..D........("..E....A.. ....8!.Q_...j.......buw..c.|_..`...8....]].k..^......}7......'.O..f.y..R...*../.m|G...W..y...z.F=h7....e..\"...p......c..di.F...f..l.-.n.n...........l..j.R/.E=.X3.......r..&..?...8....R.......}...X.$...z....Z..l.<.}....rs...-....[..........=*. .........O.V.C.s.J.....YO....~..TDE4....>:..R...o.["[......j..<.3..z...7.z. A..a{.fuo}..._...{.A...`.=.^ ..........42..cf.....H.d.3.:.j{..J.h........l0....r..U....f...b.1d.....toQ[jG..|..|.....~.]...zi...u....SL..^........xa..o.{.W. .Ut..1......{s.i`.a.-Y.....D=i.-..i;..z..O..mmO{3/mw.Z7.....K..?....L.U.Q....J..]W>..Z1....l.tcfw.S.2...).Y%/..Q.)%.N5.l.mZ.5..b'......k+Z.:V.S.(_.....f.m...e...wU......~S.}...~..*....?...'.3.).Y%/f.U\\~Y...e_../m..\..O.ckW.#s....r...([.^...kU.5..7.-.........PR).R.u......J\...x

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_eceadf_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):10587
                                        Entropy (8bit):7.970596955089787
                                        Encrypted:false
                                        SSDEEP:192:5LS2mq5Hlu+29ey/FtpAemynhbcA+XQ6nqrpm4owj9euLJcblTr85ABrA8pyCyj+:d3G+U5FtBnhbcAx6nz4ow7q/85OAgyCF
                                        MD5:1573724BC760CA865BC89E04AFFB7A8B
                                        SHA1:82BEFD0ADF9B01AE7D23D3FA523B1BA977C07670
                                        SHA-256:4025C124783C830B3125FDA65E78CD732D51DB58C451C576A0F41B269DA8BB0D
                                        SHA-512:6249A5BEAF3387F2607AAFA6B905D8EFE62A3227518803CE67314983FF0613094614621DB3E6EFA8E287C6667CF3A8711EDA54EDF58A3ACE8BE920CE717AF6F2
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......(_IDATx.\y......w.Y.(.ET..B...L..6.d/D"..:.9...r..XC.d.Fs."EB8...#....>....u=s..u..........{...s.../<p.Ea[]I......g..]...^o.xG..SK.:.b9,..."_...t%}..9...I.j%..Z...0..c..j......Bo...;._...r.l{.U"w.........SE.....S....Mw....ac..9R.j.iU.sq$..u......to.......9.....g..A.....G.==.;........}...tg'../.w......o.ZN..(J.........Y..Z......W.$..4M^e..s./.....:..+.@wP..d.~..j."..V.-I.......,..-E..........e...)._....\...J.. ...{.9..`.8"v...p7..a.X9v.[.-q..[.....'..gp.......:?9[.ZP......'.a.8.k.....4.5...V.8y.-a...>....wop/9wXoX....1E...&....<h/.V..#._..o..|<D.o..'.~^3..:.\R....&.Q..1<...9..K............5....j..u......b!LG.'...Qo.7....w.8?...~......^...M.e.X....v.{.......................w...q5..K:..j.....w_t.w............ ,~......1Et..r.|..f.XW.S.T.C=....X.rM+N.$c.oU.UW...n..{U..nuf1..Z..#p......'(.W._.\....V.\...^.W..T.....N|.....[

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_f7f3de_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):10949
                                        Entropy (8bit):7.975286464162133
                                        Encrypted:false
                                        SSDEEP:192:5Lf8jio4bI9ZPFf6lmEeBKELlTqD6cfkZVw2GIqmn+Pem+uegXG3:FI9Zh6lmpcKlTqWOkZZwcOeXubm
                                        MD5:0692EBD90503C937C0CC42F314B217E0
                                        SHA1:90775634877E018BDE5CCEBB299020173E5EF4CF
                                        SHA-256:12C9647B8E4802BC5D9446AB0CD00E717A679C5F3058F958A1EEEC5571059AC1
                                        SHA-512:1981023F51D335118F6A7F537C3A09193F2B00DEA453BFAA67C5C2D209B57C24AF339004029FD9F05AFC300FEC2C9F845F33C845077AF329B276C08CBCB76962
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......).IDATx.|{.U....>..0).9. .h..LBD.RD..B....8.......%...qHD......IB..3..>....Y..K~.....z|.......Y...-.[.5*l..j.o.....%..+.#z.~O.....QS=.^RJ...i.U.:/..tL.EMq-...|.B....~.CDD..."54...I.........s..uN..j......S9....e...Oy..`F......:...d.bU.g./Y..&]..:.....Q.G.L...v.t....r.n..;....>AA0....=...S....7......s.D..p.O..y.......t...i.._Y...._V-...".wov1{Mw....x.FPm.J.....q2........q5.E.Sl...a9N..g!.0W7.sZ......r%...H..rO..Gm.1....0..ZU-O......<..J...&o.[+.1.....n....%T0....q.r..P..~.w.. -..E.v.....g...K....4.f."1O....Bo.{..;..!.S....W^.w&D..V.`|...cr..........A#...&.@}.n...r....i...]..voK........a..+~cw.5..d-.{.6..TGR/...F..z......hqx.8=j...8oA(.S#.8Z%|!...A../_....`.....S.).....C^...Wc.............'..2..v..&'.r...(#\.j...vS...zP7._US.P..x..I...4.....~..:.2..=.~....3....(sF;...B.8m...A.........h.}B....."...H.tM.S6.)t

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_ffffff_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):4262
                                        Entropy (8bit):7.870900539604215
                                        Encrypted:false
                                        SSDEEP:96:qcNc3q3cwzxGSqXP5iizWuPWmaDWrdZdoYuc:qV63c46XUiymTdZdNl
                                        MD5:CAB25AF5D888E338ABF8830001268063
                                        SHA1:266CDB929DE208EB666459B21E1A698403602502
                                        SHA-256:406BF03A738DF2A719785300DE43D73C8DE06C51F770A287E96C77369289FED3
                                        SHA-512:BB55B80BBE7709A564262CCF32BD42EF9EAE25ADC771158C0088F0401EB6AF0E76CFE458BD5FD2419B6AD647E04D1D78C90D174D8746B7A8FBEC6C8D4D8F6E3D
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<.....O.Z.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATX.mY_.,.Y.s...s...E|Q.....&...Z.$.2!.(1.<..]P..>:.a..."....y..E..e.$B. ...........b.....A..z.....7s.F...9..Tw}...}..N+2@*..C.1.@.S............`.-F._.t55nH=..:.SO........".d\....@...3.R.-[..Y.=.qO.7p&..J2.......>.K.[..o.2...@.......9.Y.q..,...(.X.=.Y*...I}Z....#g......R....(?G.5u...-...M=m.>j.K......|..c.D.8..:...&.`.j2...D.T..>.Y...&....:.........'..Q.u.....}.......5[ .!.w@h.......J..Eh.4Y.Z..c*1....Q..2dX......gn`...#.....c..L.Z..}...1............:.K.VX..........0..W7D..o)O=kW{.j.X..RE.(....T..k..kj...D..Gv..m...S.Y...r2..P..2.R~:... .......:j..,t:.r.R.Jo...lS....0..3.)w...r...X... ..N..0../.R..@.../.m\......j...[*..-...V..........R...$..8.....ApA&..5.%..-[_....b.......n......."....;w?..+u....Z~.?|....u.....Wn...v....7?...O.|Xm......{...+...#.&~E.K...#..U..G..w..._B{......+.p..!...K..6..<c.z.P.1..Df.B....gn

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_65_654b24_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):14498
                                        Entropy (8bit):7.981807801007253
                                        Encrypted:false
                                        SSDEEP:384:W6r9F7HYHPQlAq0izgtUYKO6OH61y7On6mbbvb:hr77jlXMtUmzEcO6ST
                                        MD5:0DA5C3834D6BE7BE8626B10311D7D42F
                                        SHA1:79495C88AD23AE852925658F05858128F5B8F9DD
                                        SHA-256:861A442B54D565C15E61A9BB056223B2D21A2E7ED7C245A9A2E701CFE55F9BD1
                                        SHA-512:F6D61966E32F737F182A8A91C5729E615691E1FDBE30391D72B9198D41BE2ADF353FFFEED510DEAD0905271830D71ABA88CE267D1D7F4F1CCE06D2505C4174A6
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......7.IDATx.u|wx.........7.BG.$."..HG....AE.E.EAA.Q@.....!D...*.'$!=....3....|.{.>.Z6.S.=.=.y.......3.=}.9`..l.V.9T.....-..#N..V.}.$K/...H...(....B.a..'.j%...ot.T....*|..B.... .m:n.L.v.e.N.u.ehr...L..4>|.EQ).j....>f...--..)ldR.bZ.h.6.~...U_........|.(e.a%.2.|A.........wg|.Od~.qg>..Pc*.F.}...+\W..x.....~..OF......).....|.s...."..Wh..[......+z1..C..K.....#m.r[....X.L.sA..-..1./.....W.a."5..F9h.~..uxR..e../....*.s..p..Hz$di.g....}.....6. &S'..&...././W_.gS...M-Y6GB.(WF.....:.P..o] T.$..k-.'.T....N~..}...'y>.-f..4:.'..F>`...4:i{..h,:.,Je4!...K...../.K.m...V...%D)1...=t....y..6?~.,....QX.n.?...^......W*~5!._......=.X'...S../......gBF.O.-.F{Z..m.6M;%>.\..!?.}.(..C...d...!../..j[.lR.7:......U..9k..+.-.=+.....B.f.p.2r..P..e.m...f.Z{C;,....P../.b.P.....C:..U..7.nC.$..w......]...D.x>..d..L....r.B....~..2. \....5.4..'....l.!......x

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_68_b83400_60x60.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):11935
                                        Entropy (8bit):7.974771171812448
                                        Encrypted:false
                                        SSDEEP:192:5808KiNNatDpFdo+f5vdIEzqTq+QNzNkb6JeW4aDD73XIR/hC05uJz8jlhAT9/E6:sratVFdoy7qTq+QV26J/4a/73XItxCoi
                                        MD5:A020D1BCD94211F5586B0F8E9F2EF0C0
                                        SHA1:3967D2426F4BB056314ED6B98913101EE87CC77B
                                        SHA-256:6F34FCC0397A1751505283E1FF893CA6A8755578B2A7C20737B037C74718D6BD
                                        SHA-512:ABE69894EE57DEC8F0EDF00BD3F7FFD85AE4CA87EE45A6C87E404ECE01514BBCE3F3BAF2EBCF08EF0B198CD182EE5E8CF3058F17B5DB2B3A0721754B97C90B95
                                        Malicious:false
                                        Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......-.IDATx.|itSU...7I37I.y..2..B..... ......# .8 .A.Qdx_.'F......ED...R....M.4.xo...q...{...GWVrs.9......;...;.|...\._.....>.T........i.p..5......I.tB..z..T,|.4r....Wt.,+.....5x..B....t.{N[~..%..t..X.......;_l.W........rr....T.F.Z|,..0.im.4....=/...u..S.uvZ..Jr....H~?wc..0$n.w..s.....iG....`G...V...:.|.9.......5Miy.....=/55..wF..>7..I.E.6.1y.:....../G..n....:........=c.p........pG0C.\..!....;.w.pK.%...D*1.m...\.X....h..m..-.U.q..GS..M.:{....`."oc|\s...3.sz. ...t..x...l..`.T...^;.M...k...Ew.....T.F..n(?..&..K.\.pg.b.....u{...W*.........x...%....Ll.x-.h...Z..<c]....b.P.+.......<Q.. .8v$x.W:.C.......r...P.../..../.X.|.r.sR.;..8Z.....V.oZ$..4.........Ri....d.V......{..x$l....ox.y.`{m.X...&.#.....-...=-..4..HR`...\Pq^2*ST'..y....2O.#f...Z<^..\.:!8..N.q....." ......x..N*O.>.R..r..)H.Xl.R.|RF^%.{Dsx...;.3.V.KH.......G

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_3572ac_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773976636383107
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:6050985BF56D772CAFD9CBBCF250A1C6
                                        SHA1:DECC56F1C9D6EF03F460AA3C05501F832200B974
                                        SHA-256:827F9976FC547BE3ED6E1C4D26EBBF29541A6622DF34BB54D93099D5D6B3A89C
                                        SHA-512:167D88C7375DB41B0D39AE27A6C96269B0A251711BC807856F0CCE953A525A9FAB87D08256FC917668F5D215C3EA5D2E396CE8F8D4F53C4BD61F5F742C819FD2
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r....#...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_8c291d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.782986442029293
                                        Encrypted:false
                                        SSDEEP:96:vpNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vxHm231Nvu+wIqltWOe3nIP
                                        MD5:48EB999570CAD20502F8E097D5EB06E5
                                        SHA1:5971D205A8D5D3998D0CC9324FF96B89D32574A1
                                        SHA-256:A7EFC92E8E7DF84F638AA5F70E885D980B021B395A34848F018D02E88136B660
                                        SHA-512:59D6EA123399B752374D9EDD8D50D9EAC0BA08DE098F9D9C4FA6D2C46DDA4F5AE2164B81BE930C6A189035FC84C24069305DD558B5BF1A3C0B2A36C7B1430CE8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)...]....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_b83400_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.746555948985092
                                        Encrypted:false
                                        SSDEEP:96:sVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:slHm231Nvu+wIqltWOe3nIP
                                        MD5:95EF27B1709696916D21651EE58D3DD1
                                        SHA1:355755432E0AF2450681FBE77D87D41858C0DC2D
                                        SHA-256:7FD672DDF99D36C9429B78B8D16D579E917B9894C0686C171C3EDC568A0F14B0
                                        SHA-512:9274CC96C95E84427C9E71B5EC476D916489CA113B53D3163E7D8AD6E6499A042F18FA584651418F3A446FCF9550D7886FC700BD730F00FB25F1C618F27CF85F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4.R).....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_fbdb93_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.776149396506033
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:4A74B78D6A9AA2A787E1CFBECFEFF7D7
                                        SHA1:8CF70518D6D29FB3D57EE0B6A861308DA6B33383
                                        SHA-256:3CABBFCE55BAB5BA6DA058F7BADD6EB850BB2C9F3482B985CCC2E91D52F52229
                                        SHA-512:E95BD2A3BC0FE051FFB1537DEBAED206309409B910502E40FF918A62FA55080FD2E134610BF7EAC483D8AA6D3CC93B9892FB3903B41A47426F7DA38D8C6D744F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36780
                                        Entropy (8bit):5.285425649734029
                                        Encrypted:false
                                        SSDEEP:192:10OW0PLNI85HdOTb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEUw:z5I8RdSb/+vaW1e07nF5fyMhECDS25W
                                        MD5:505163E1FD8778CDEC401940391F247E
                                        SHA1:9B456B5EB491691D00BF416A11A6F138D55F57A5
                                        SHA-256:A44FC0FC779DA7F50050C20F425F729862127783851E4D7C14C7611739C43E1F
                                        SHA-512:E28B9C3DF796B76AB02BC1CF871B317286E5E2C5C1E381A60CE8D2B81CC0179824F5161ECF812ED33A1692E78A41731CC8A4031F67D7C7D4A7822F4FD82AA681
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgI

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29724)
                                        Category:dropped
                                        Size (bytes):31557
                                        Entropy (8bit):5.2301095862972256
                                        Encrypted:false
                                        SSDEEP:384:z5I8RdSlcR8lOXHc11evF2XHzkmBGQv+4v6GpqrrSc7nfZBhVk4:K8VXHcE6Hz1BGQLv6GpqrNBha4
                                        MD5:477009769654FEE8AC7335A90907F54E
                                        SHA1:E533C54D97DC5DC0D24D4BD917A7F08AEF66C876
                                        SHA-256:E3B11AEBD7510C45AEBB9BE978D021B86789C55866FAFA75786147EDD5B9B77E
                                        SHA-512:D170673AF46C6A34A6F1B9E4FF57C5D4289FD0672E0392F65D0023E0AF61DD940F0EC46742E298BDDA96AF3FC3744B2FAB6E33A8E791DF86BE984CC6A2444684
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgI

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1410)
                                        Category:dropped
                                        Size (bytes):18126
                                        Entropy (8bit):5.0950206722906195
                                        Encrypted:false
                                        SSDEEP:192:XRLNI85HdOrSedRvx/F5fyuoUaOEcIupn04HgmB0iBfT9RhS2wV53skuMaaSQhQS:XR5I8RdmF5fyMhECDS25W
                                        MD5:66DFCE3BD59F9B4E02FB34F63B209642
                                        SHA1:5326286217E45DE7ED7FED98EE5404C0D740B485
                                        SHA-256:72A8BDCC98DFD935809EA7037022AAC9E39B23A43B6E2C8563986B64AC5D231D
                                        SHA-512:14C199579958ED774A376BA83ED45F24CC35079D7E28F7AC7BA0A7703875A498DAF261E9990960C0E2C565A56A2ED66C06E33B6122B4C45C33D9E5A30FA9F63C
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgImgOpacityHover=65&borderColorHover=654b24&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=eceadf&bgTextureActive=fi

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_75_d0e5f5_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.531973512673736
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+WT/RtUFoUkxfx8dj8f5B2zS+Em63KEMlOX:krr9+i5tUFw8dAf2zjEmdEMlOX
                                        MD5:EB83AEB42FD8D8F74C93B391951BCF44
                                        SHA1:80EAEC927C8AFAA6C7E737CFF9B3511B5D1163CA
                                        SHA-256:B88090516DF43FC1D344ECD886301DB6A3EF7BB4FED3E0F654D79AADDBBA6F22
                                        SHA-512:C93C1DE7F09C51273B5A6D70E55288806BCF4CA373B67238DFC565C211893BFE29C5208568852B113093A32FEC1EEA26F0C6A9D3DCFE17D6D3B98EBFACFFF4D9
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH..............I3. .l.&.t..+h.D.u....)..9.v.....O..M_..}_U.. ....<...4.FSu.!;Fv...k.....-.\/R.T......r..)...1.r|d..&e....+.V.6..... ..o.'t.+.`...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_85_dfeffc_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):399
                                        Entropy (8bit):6.554533150250573
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+FVMhhYjbXrsCLzS+Em63KEMlOX:krr9+nYEXVLzjEmdEMlOX
                                        MD5:A697D8FD8A5ADBDB87FAF8D78A90E755
                                        SHA1:382755716BE10E2AEBAE2BD84711861CE687DC58
                                        SHA-256:D868C700B7693AAC8374D6C42569AD8FFCCC35A8F16B534EF6EC72886C9EA174
                                        SHA-512:661D532794A11ED85E87753FF1252594BBE8A5385D8D55910E0E6E5377B211DFBEE8EEB3ED7F7D105DDC20BCE4C8329D5527F1D13A5E137EE40431D6D85BA81B
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...!....G..... ......M.a.X..;....v..b4...ZD.....6l...~..Gr.J...q...p..iQp..FeM...#k..lLL [.......}/...N.I...g;.W.l..lb1.7..9M....q......'.l.#...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_95_fef1ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.486146272952941
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Awk1em+2vEKvEA2zS+Em63KEMlOX:krr9+JAvEJA2zjEmdEMlOX
                                        MD5:D699723AF8436EBA22B885328314BD55
                                        SHA1:E98D44337839A92BFB993E56837CAAF0E0BD0CF6
                                        SHA-256:F3F6CE30DA7D2A7F442379FF3626F3252A67FB874A3F7304B0751AA7157EFAEF
                                        SHA-512:0647A00337946FC123B57A842267DEBCDD4CCC34346283CD4B43D2A777E308164991CBE72447F191CFAE424A44CF1AAD9DCEE6B6023214C84CA67D2C8D5149BB
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_gloss-wave_55_5c9ccc_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5882
                                        Entropy (8bit):7.694397536982677
                                        Encrypted:false
                                        SSDEEP:96:fHVCXcDHxneFLdekEyCcsZ8rj/iGyUS6hpYJ/wEl89vw9Xdewx2vVI8n2RKvrogF:PVCixcLzNtlCvUSn1lQgXd3EKWDvV
                                        MD5:C56BA853727C57C51AB90B9E27F7F2D3
                                        SHA1:4D505484B4A7E3611696C792846BFFAEAFAA8CB0
                                        SHA-256:7A405954C99E375B7831162EFABB9D8814913E928F79CE1C5E641AB62EE05B11
                                        SHA-512:428746347A051C02D27A7A6CA3CADD9301F90E58C0DD48EBA7F179A4E28AAD12771081959D5DBD14911643078773859B6FA623414B5B327D58BE5077340D4F00
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..O.].]..}~..R..Q;."YZQ7..*.H,B.....L...B.(R.......... ..Dd^........t.ph.......#`uSU..,.$......s...|...........3s..../_..s......&.l.........q.....X.........l........6......k..w.....5..;.............`.`.........q.....X.........l........6......k..w.....5..;.............`.`..........qo..v.._O..[/.l_OYHE..Iy...S#..<.:..J...o..J-}\.qy....dVQL.Q....FS9y..k9u.......o,C.}..r..z...}.Q..C....ztz+.wK..r.J.....&...m..+WU..d...[l.}.]...P.....`.<Ge.a'...w...$e.ne.jx}S..w...qrm+...*...s4N....7j..z......%..O-.yy.k.d.h.7...!o.J..r.m;u._)..y.7...[.JF.7"{5.Z...k9..|.......2......`.."..W.......X.T......5..;......0o....l./.c.....BW._._.o'U&.c..jE..|..*.UJO.u]g]I%Gzw..QZW|Hy..[S......j.Y..W..ny......k....G.w....+R.9P.-.+/wy.#:..(.?x.:}..[=......8Y.....[.wA..*//..%K.r%..1.....j..co}....i.o......./._.oAo.....G..<....M*:

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_inset-hard_100_f5f8f9_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.49868315999616
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+M8YprWjpErHohKzS+Em63KEMlOX:no19+gijpE00zjEmdEMlOX
                                        MD5:EB961B27BE02A26AF523A68D5774AA6B
                                        SHA1:711A6C424D8C5F030B20200616D5DE0716BEEC04
                                        SHA-256:F6AF17A4397C4302D2AB2FC227B04C185412B7AC1AEFF7E23DF7E42375CADF94
                                        SHA-512:5B925A2E924F10003753A12D9BD4BE126BF077FBDACE0591A7450FD2FB500B363549BF05B8E84AE8B1AECB822E70C87170D41446CB6DEA09D8BA12D8F68C6955
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(...!..q......&.h4I7.M0.;.....o#..I...........3_A. =.!.BU.../..i;...)#!a.|..p!...u$........M-.&.....[...........!v.O...h@_hP.V.mu...o6=.9A....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_inset-hard_100_fcfdfd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):6.206000010177241
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5Em3MFQ3fK3B6tTLpM52zgN+Em6hp/KEMlOZp:6v/7WogU9+C0MtTLJzS+Em63KEMlOX
                                        MD5:63B926C3D199D7774678EC2F1CFEB44A
                                        SHA1:60483976063220F6BFC4508287E98522312EE277
                                        SHA-256:0AE17677A06192D5114347DE45ED6C6F2C3A660C1202AA6EA44E12BFCE7AFE5D
                                        SHA-512:7BE4D05ACD6519F4892F63C0D8F31E4AA6DC3DAA0467B9F93F2B3C3653A87C1CFCEFD267BA03A137EB110C7197F526ED8A03C227ACEB06D2F63787708F103AEE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...bIDAT(...1..0....`.JE... (z....BHm.......u....~..5w}."....^,..bcb.$..A"..H...V.A,npC...xQ!T..ry.D...H{*1...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_217bc0_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771544173244556
                                        Encrypted:false
                                        SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                        MD5:33AEDE1050C87FAF490EE203D3D47699
                                        SHA1:3C5BF5F8F2C247D6054BB159A5D917FD8C451C01
                                        SHA-256:00D56BB88843D18972E22608E62E879030C321B2DE8891AF2E1D819535570ADE
                                        SHA-512:900C386ADBC961DCB12F5505C599506BF4C4D75883FF6FA9C524499F1F839C9033A9DB69EF9F6E876CEAA24F7A9D5865E263BB4828D3C0C68BAA2F0629B7EE02
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_2e83ff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770844676212274
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                        SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                        SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                        SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_469bdd_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.772511909269724
                                        Encrypted:false
                                        SSDEEP:96:ENbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:OHm231Nvu+wIqltWOe3nIP
                                        MD5:ED2F2BA37982B5F821D46811A5F79836
                                        SHA1:CB5A57E11754974C65747E3617E119CD1F0A31BC
                                        SHA-256:4C7B9E02B3795BEAC99A86532240ECD9FFEAB750769B1E7EB3A3B3CCCED57134
                                        SHA-512:4C3C10EE9D1A6C0201561548594D673C77919BD9C0435B8655548F280892DDD046FD41A3F12A20DF046E98DF84F5C831EFEA53FCE7FA583FBF76BBC10EA36F54
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEF..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F....c....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_6da8d5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7780236195661985
                                        Encrypted:false
                                        SSDEEP:96:jrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrX:jrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrX
                                        MD5:72019F22CBCF7555F4BC97AA383F164F
                                        SHA1:E26300462491C199D854B4F60E123D2091111FFA
                                        SHA-256:A3C75E0F64A223773AD58FA87037A924F12C179394FDBFA1754EF38D50976F42
                                        SHA-512:DA05D87F8F767A983953A235AE33C3A4097BC8E3626E18FD4C145A3D6902FCBAE6AB3B6EFA925EAC8932F29176763A9F602552950250BF4878A3B50B2A889251
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEm..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..z.6....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_d8e7f3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773667817462664
                                        Encrypted:false
                                        SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                        MD5:06F311C437236B376B247382BF815C71
                                        SHA1:110DB3851E725E1CD30D73D292201A6699344E4F
                                        SHA-256:061647E5266E0E229DEAC8AAA16D839EE64DA5C0E7B972948DAC3D071D27F547
                                        SHA-512:C90F60977BCEBDA00CE1D77748A3E2C4F53D9526B867537143D3137E4134858F2C02D45F5521699EE0EAFF6AE4D54C4217714D75E902D89D45EB8826ED51D7A0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................e....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_f9bd01_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.755062961745714
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:C34E7954FB08D6D72348B49032DC4876
                                        SHA1:520468AC13D56C1F347A16DB73003C414C102F56
                                        SHA-256:AACA89AA0E8E287A167FBE6108876C274643080BE32C4A33BDED73BC8F970111
                                        SHA-512:E3DE7AC662DB301C7621AB4D428EDA5398B273D57DF43B449ADECDE1B24ED0171DD6226BACB25C7DAA248533EA2D88F9342B5330F2A8AAB1006662A8EB447A38
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................................................................................................................-...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36609
                                        Entropy (8bit):5.277735665991303
                                        Encrypted:false
                                        SSDEEP:384:6NAnb/+vaW1e07DVsF5fy6EsDS25Vc6Kvlak:SAbGP7DVQDS2vc6Kr
                                        MD5:F9C03B772B04F821D5DF95A7E978F0FA
                                        SHA1:78369FFE698A3B97519C2F68E71AB49961957993
                                        SHA-256:CD48C6B94CA9ED82E69CE5497D66C68E48C2E40C9874D5618B5EDD940759CB21
                                        SHA-512:1BA64B0EEA23BE046EB6C475878ECD5ACC19F8A1DAE70471BE5C0C65D4E3F078B2A741676A61B5F60FE6FF432D71D2F579EA2B6C8D325F0B89B524E17A011D4D
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29596)
                                        Category:dropped
                                        Size (bytes):31389
                                        Entropy (8bit):5.222039123586008
                                        Encrypted:false
                                        SSDEEP:384:6NAnlcR8lOXHc11evnPzkpmX+4M6GwXKJSc7nfZBhVBWGc:SAOXHcEnPzkkDM6GwXK3BhQ
                                        MD5:33AA343026B23D274B73B0696D159167
                                        SHA1:6969B39C578EBFE70C5EDEF7572BC2468AE415D0
                                        SHA-256:A578F0FB1E1D3A84D98110663C3FE294415C7118F6739EEB65A623F40F6446B4
                                        SHA-512:7BB4728EF22EA1B60A4C56FF1B187C9322686C1648F4730361A1315E4C4597C9BDC7A13FFB3E3A9F1FF7F2A5452F7D368B9C815DC4A7D42A5C10B6FD515D6144
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1370)
                                        Category:dropped
                                        Size (bytes):17955
                                        Entropy (8bit):5.081854892281221
                                        Encrypted:false
                                        SSDEEP:192:XYNAHB4LCVrwF5fyJ/cEczYq05NQgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6G:XYNAdVsF5fy6EsDS25Vc6Kvlak
                                        MD5:D641C1A55384E6F0B0D8137916F7113E
                                        SHA1:9493284C7A649EDE21D6E806EFB0337782433047
                                        SHA-256:E5E4ACEAF8F1C37A5CB9038C98816C7E3CE03940EF873E2B4AD087AE71D23B7F
                                        SHA-512:BAC8933AB878C62592BA734ACAF88AF297B5FB99195716068C6A180F26DA73B37316B318B4F362F830EC7F8818126E4A4B70552498F374B6CF6C127EBBDB0111
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=inset_hard&bg

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_55_fbf9ee_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):393
                                        Entropy (8bit):6.51579365852352
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+JgR8nBtx4xzS+Em63KEMlOX:krr9+QwGzjEmdEMlOX
                                        MD5:DAAED3CF88E742A2D3820B4C8C55F3DE
                                        SHA1:00A345857359FC294C80A28E8662408C31BA602D
                                        SHA-256:20FDC83C863EBC3F9B0BF34A4B6FB7FEE55A2E03B77B6303D8D000028525B79B
                                        SHA-512:900C94334A4651E808EE6BAEA22901636D44B2B70A0992BC7D6AE733D316EEAE69F857CFAF665CC1F10B76069A25C3DBC3FB6FFE120FEAD1E8BB8893C10E998C
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...!..A.....b.l.....A.1{..V.Y0i..x...x..v......D.K_..O..9....a......}..^..Ja..0b.vBA.$.,.Q..."_44....=.Sqc..yE..I..W..<kA....i.0....<a$S..y....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_65_ffffff_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.620668247500632
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh3EUyKO0kIojl2XIzgN+Em6hp/KEMlOZp:6v/7J0U0SXIzS+Em63KEMlOX
                                        MD5:ED31481B45167E6F49FDCB1499911BF3
                                        SHA1:4C129F32CABDF52B0EAE217A30360C3571390986
                                        SHA-256:15470C38D6F3194815FFCB9CB182EE4AED0C4E0839B7B5AB0A5FC1C6ECB67C63
                                        SHA-512:7C0199CF2FFB71B0CD5348E7171AC0E2263EBBB92EC8F4C8C659EDA552FAF1B0A34B3263DE0F044360F50E86DDB3CEA23F5CE1C63AC2C514789C58399397A0F2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_75_dadada_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):5.9920009116983115
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkMtu+UpQ7YjbIzgN+Em6hp/KEMlOZp:6v/7JSUM7bsIzS+Em63KEMlOX
                                        MD5:9B9F1106E912005670402C03BF82F170
                                        SHA1:8B7728C1588050612D7B3F58FA864620968F0C9F
                                        SHA-256:00EB8C3EA9655DA88F6AC78D327FC9AE95F56C5503BF21BC6510C14BE77955FA
                                        SHA-512:F0606E260C42AD909CDBDAFE1E86A4D2F0876980CCD4F20DC8145314021CAAF23945B38569C3FE90C835B02E9FC21BA73C6B817427B86DADB408538CD9978361
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...KIDAT8.cx....a.."*....n{11.ab.gb4a....)....&.v......11.01.01.fb\.. 3...EC...... _>o....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_75_e6e6e6_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):324
                                        Entropy (8bit):6.098454715199907
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkMkp5RqM5TC2szKMvzgN+Em6hp/KEMlOZp:6v/7JSUTpDfYyUzS+Em63KEMlOX
                                        MD5:DDD65FFF8A75A609B421B4E3237EF807
                                        SHA1:726880A9486CF2D048BFAE5EB03C02EB10610B85
                                        SHA-256:0756E317C0F7C8B82C40B80E24BB62654E36E8CEFBF2666837765C055443B232
                                        SHA-512:EA5CD6266C09D1149417DFABF10D4CF60F3C6F12B13D8EAEF7CA76C5A5DC191D407D3AD271D60F7B9E1784704E045DEAD1E5A447E471938DD2F82C573D608A2A
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...LIDAT8.cx....0.F.u..g.....ab...x...+..7&F.&FN&.oL._...3|dfbX..I..Ax..<......0.:.. ....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_95_fef1ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.486146272952941
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Awk1em+2vEKvEA2zS+Em63KEMlOX:krr9+JAvEJA2zjEmdEMlOX
                                        MD5:D699723AF8436EBA22B885328314BD55
                                        SHA1:E98D44337839A92BFB993E56837CAAF0E0BD0CF6
                                        SHA-256:F3F6CE30DA7D2A7F442379FF3626F3252A67FB874A3F7304B0751AA7157EFAEF
                                        SHA-512:0647A00337946FC123B57A842267DEBCDD4CCC34346283CD4B43D2A777E308164991CBE72447F191CFAE424A44CF1AAD9DCEE6B6023214C84CA67D2C8D5149BB
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_highlight-soft_75_cccccc_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):325
                                        Entropy (8bit):6.170136138042224
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOk3S3OKjr09zgN+Em6hp/KEMlOZp:6v/7WdU3zS+Em63KEMlOX
                                        MD5:5E93533BF9087857A8369C2D27467633
                                        SHA1:AD5B492E37E840A22A369631DE394245159CC6F2
                                        SHA-256:B8F77242E550E590386C19F50E0F15F6615ACE7AE557AE5048FF56F8937A7B2B
                                        SHA-512:6263DA0A73674599C94E10D0E01898D8C6F07DBB6297F9AC20009E9D9A94202BE13B4B1737FF7A2E45F1B8603B13D57EEB5DA4E861DA28E831C932729E313D34
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...MIDAT.....@......n.jn5.$.@...(...'G...i...D..7\.....;N...p.....-.u.....&........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_2e83ff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770844676212274
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                        SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                        SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                        SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_454545_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7090
                                        Entropy (8bit):7.925434318681863
                                        Encrypted:false
                                        SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                        MD5:5C3BA680CC34CD9B30855C180474A152
                                        SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                        SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                        SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_888888_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.928604829942714
                                        Encrypted:false
                                        SSDEEP:192:O+057dZiVq1IWkYLeDEdEsyyL47BhYk6aNCdjh4:O+0pWVljYLREsyyoA6CdjS
                                        MD5:CF9C28612E00F36E9C312DA7689AB3B0
                                        SHA1:4D8D263100EDC2B443EF6C7118417126DC6CEEC8
                                        SHA-256:A046793EDDD1EB9087A6118ED0ED442FE8E1FA4BC4DEE13CDBA2029FBCA010AC
                                        SHA-512:B2B4DB53A81CA36E36D64CCE853F74B0814BF34C8D3807EDEDF84CE4A2EBE9613C335874F1011773F305345E58A0EA1F1DC15559A7DC5B0286A14694EF7F3942
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..I.( ....tIME.....%...'E....IDATx..{.eE}.?.H(bX.!..[R.`....J.H..!w..M.b...F...h...............XT.#.D.T.;"ba.Rqw}.......G...)b.....}N..9..sO....s..Ow.~.8......<..3.......@...@F....3.... .....$........+.\.....$...................Ook...0.Z."..."`Jy...Q.z...B.7i..Q'...........q.....I..v.C.......T...2..m..k..5e[.7............G.t....k..!HL.^?3d.J...[...f.Z...S0.Ms..}`.....T8.t....US...........@1.a...`..fe..k......6.^.../........@........px{.|.A...Q...."...i....O....=.]...}....=....\.z...\..mc.-...>....(..D..'.L.6=.......;........l.............=.....M/>....6..(.....0.......$%.GI_.km..+.$..q.....W.7.~!.....px.h8..4.^.../.........QG8.U..k....V..}..A. ..*..s.%......~...a.JYT}.-....c*v......J.=C.`+~.P.}....\....=....4...3.....%4.Ph...F,._..\....WR..>4j"m.h...i.@I...zJ..y..ts.Y...@.e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36536
                                        Entropy (8bit):5.275194338840845
                                        Encrypted:false
                                        SSDEEP:192:10OW0QYpynb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURH4N/z:EYpynb/+vaW1e071F5fyBErDS25ulak
                                        MD5:BF051F24690699BC2665EF6E4D7487A7
                                        SHA1:0A5599C5783E60B7D51E928812039F3F5C74666A
                                        SHA-256:F9B751C1CD0D2B0F91862DB987FED9DDA48758B15E6F42CA67796B45F4B21702
                                        SHA-512:B0E0B50B753FECBE36028D7EFA3C150A99E59616F19DF0F9DB9241644DA1D7E7189CB8376881371B544158A4ABFFD705E4BC41D42C4F72402F1EACF3ECEE1AA5
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=9

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29523)
                                        Category:dropped
                                        Size (bytes):31286
                                        Entropy (8bit):5.218372761012579
                                        Encrypted:false
                                        SSDEEP:384:EYpynlcR8lOXHc11evnpz5mG+4e6GYEKlSc7nfZBhVFWGc:E4yOXHcEnpzUee6GYEKDBhM
                                        MD5:3C2A865C832A1322285C55C6ED99ABB2
                                        SHA1:B456F4C43E3D45F0A85811E2C60B2256DFD2EFDB
                                        SHA-256:BE92933B839BD4CE1B67C440BD9BD832D8A7333D578C7D1061D00EDBCEB557D3
                                        SHA-512:FB45616EEF2C454960F91FCD2A04EFEDA84CFACCCF0C5D741BA2793DC1DBD6D3AB01AAAE6485222945774C7D7A9A2E9FB87E0D8EF1EA96893AA6906147A371BB
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=9

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1340)
                                        Category:dropped
                                        Size (bytes):17882
                                        Entropy (8bit):5.072830940698532
                                        Encrypted:false
                                        SSDEEP:192:X2YpyqN/tNwF5fy2+kXcEcINyB5NYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhdlR:X2Ypy/F5fyBErDS25ulak
                                        MD5:E4327912458100FAA111DBE7BD75F4D9
                                        SHA1:A2566EEB6FE07C3C1ED420E7847D92447457EF55
                                        SHA-256:EFA52E8C5D9D6B5E4F28174788304FEC2F279A52B999BA6B806AC852A12A5509
                                        SHA-512:A2A62110A5F170AF0225E3695A5E41CB56997C0E361931751996FB0182CAAA08C201983105978DD2D88608FD8354607351751832D8F3746FFDCD715620578734
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityActive=65&borderColo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_glass_55_fcf0ba_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):391
                                        Entropy (8bit):6.55690601973133
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+D0hJkHTx1xwKzS+E3V+2EMiVw9:krr9+ghWxwKzjE82EMr
                                        MD5:8BF4A2E7590E3970ACD416CD3316B9FE
                                        SHA1:DA0F754D6641364067F95A83C7B65286CD2DE909
                                        SHA-256:4D3E42B5EE27F39276D1426A819549865E285CA0018AD323CF526FFD172971E2
                                        SHA-512:0022BAAA1E32215DCAA4BC6E3E4DD511979E52EC4C6BD200DFD4B1893006D3FCD6958CD1324AA051F01E6E505CABE28CA6D2AA79D0A8A8E2FB4880E816283819
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....`....;E...Zv...n..V..5{.^.........6.....h...^8ph..x....q.oC.e..z..........vU.o.1#...Q..vT...."...kS;..&.u...,.).>._.v...!.p....|@j...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_gloss-wave_100_ece8da_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5817
                                        Entropy (8bit):7.684670763456218
                                        Encrypted:false
                                        SSDEEP:96:fHjNcCWhpgKcYa69MWkATL587NYTv8B+C4CS2fzwIznpHDHIawkGfUin7G:Pj1Wjg0a69ZASTv8BAwPzZHyUAy
                                        MD5:B48C85BA6D9BD33B52AF8D73E3374E8C
                                        SHA1:EE2D179E2EF219D3BA8AB8EE8501EE5B803D6552
                                        SHA-256:C230D01C2F651EA4CDC8FE31984948905B5561DA9EB8C2E0DA02A3BDAC1EEFC9
                                        SHA-512:D3F2EB8012B14CC9FBD1EC1BF3B55C9BA6B53025D775C71CE83CB05DEA3FE0835D64424DFA53A1CB704424A68E0B0EFE64900C9B5EE37318F69A1BB4BD74DDD1
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATx..K.^.U.......1.A.....A.ZG...A"f......h.....{@.......w....".!..U........4...o.P....n...R$...=..{....|.s~..ss..k.._k..{.._.r|.r.........j........q.....X.........l........6......k..w.....5..;.............`.`.........q.....X.........l........6......k..w.....5..;.............`.`.........j..v..-...Sm..K,..S.RQ..<T..7z.b^.l.%...Ds..>/....z.U2.(..gS....TN.,.ZN..V..W......WF)..g.\.W.%/.5DQ...Z.-.&.+P.g^.{.5y...l...X..J,%..<b|..<...........$xn.Y..p~..9P..5{....M92>;..O.k[.q_.2JK;G...~.Y...;.u^..K..A.Z6..7z../.<o...C.....r.m;u..)..y.[W.L.].Jf.7".j.....x|..{....L......EX..........'.U.....`.`........,.e..[q3..G.'....}.a.a..T......(....<.RZ...G.u.Tr.....2..C..>.5.N.\..WK.....}...W..K.7O.?z...n-..HYS.@.Z.+/wy.3z...Q^=x.:.z.w...c-...d.K.khA......x..,..d6/..J...u....>.6.....v.V.H..a.!..C.....e..q.).S..:....S<..F

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_100_f5f3e5_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):394
                                        Entropy (8bit):6.418949384814716
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+DRCLwIBRzQ67pPJgzS+E3V+2EMiVw9:no19+QdBxQSphgzjE82EMr
                                        MD5:5AD852FBFDC1BEF56FD9FA29D82337E3
                                        SHA1:8E93097664FB53F9CCC19C5ADDFDDCBB1E81279E
                                        SHA-256:29A7A7B7A0506713D11B755F68836DA0905AB86CD0A3D65B5CA8CF81F0F72A1A
                                        SHA-512:99844BC6AAA0132DFE2299FAB33A4A679C67EA2DF94FD132194756326115C72255B302C4C90DC71ADE0DA5D96DEEB948DC2C6D63ADA5FEA12BF799E2566973AB
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.c......>&......Q.......3..[~..r..a...."..^.|..4.C;C....?.......g...w..~..^....G..o8......j+.C.............a........~Q~.......O...7.....BB..o.p...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_100_fafaf4_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):379
                                        Entropy (8bit):6.402477277052991
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EWqiXm2DIHeZttpEx5wMI5zgN+E3VKF2EMiVAVTp:6v/7WogU9+mXmL+Ttqx5b6zS+E3V+2Ek
                                        MD5:F6D7F3181C5D064D2889525322F0E928
                                        SHA1:D2F282EF7C8955CE88076A3A757ED984FF1DE59F
                                        SHA-256:C448B81DEE17998BEA1596080F0558AAF5680EDD6E7405EDDC951DEFA54C5DBE
                                        SHA-512:4E84F814F417993A5EACD47465915D7A1CD073BA88FB0917B50DC5408E497220EB87F2833DCDD6013636641F66A5A5BCC926E1C98A2CF250C5DEB62BAB2EF665
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P...?7.3P2..8..0.....k.P...5..@LX.|...8..1....ww.......l..L.&..&D".^{.?.di?a....00.`.U...<]..Z!..N......[I.9..?....;.qT|....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_15_459e00_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):6.430777033274858
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EBsSO3WopfvcMeGGrxD2CJzgN+E3VKF2EMiVAVTp:6v/7WogU9+/O9pXcMeGGJ2CJzS+E3V+W
                                        MD5:FDE0ACA7B0C5540F60408E08EAEDA139
                                        SHA1:957FDD70495B752FA260816286AEB1F24E988178
                                        SHA-256:A48F5D8887DA20CF63C77E9E00D688EAE209E4C92D01E0D7E3257749B9E0F69C
                                        SHA-512:34B2BD05B5ED3B8A28F204481CF136327D055B2EC44693AA1987AEC248DB710857FE19583B4F16681FF621807F08A614266B86C8BF47E12E5D245B780F069305
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P........NP&@A.$.$.L...1C..)P..].f..c.<$......zTX..?............U..fLL....TQ.=e<.;...U$..Frt,.6Om.`LCk.u..;.?..E.:.o.GQ...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_95_cccccc_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):317
                                        Entropy (8bit):5.9481014168776705
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkB6+pLcXb0VDSj2zgN+E3VKF2EMiVAVTp:6v/7WdUtqXWzS+E3V+2EMiVw9
                                        MD5:A59F6D7582F1126FD096A883D295AADF
                                        SHA1:6E52C2B7763CAFDDBC13CEE0F1DA0E1B5C850145
                                        SHA-256:D7208E0189A4C99B0C7DCF585C92397DC22A12699DC9CA5FCE5C04363F761CDF
                                        SHA-512:0BAC5EF6895D9DF5E9FFCC80123AA7B325084B960C28187426066503AED7A487BFEE192B997C3F8A30AF38300818CAA63F61B36E59075C85AA19C18E79A5DF6E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......EIDAT..cx....a..y......c.....6...L.[.n.d...p.0.e.....I0..`.o;..d`b`.....o......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-soft_25_67b021_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):411
                                        Entropy (8bit):6.622951677016995
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+G4VCOw7L090zS+E3V+2EMiVw9:no19+DoOwf090zjE82EMr
                                        MD5:916F5242DDC366581A4E27F587414435
                                        SHA1:2477511778ABB7FACA494FF07BF5F82912897124
                                        SHA-256:925DB451C705BD16B66A084ED9B3656387830131868E5E92A8660DDFD499D7F7
                                        SHA-512:03530567A01F90B3DC7E326D9EEAF97622D0A209BBCE89C5FC9EBF53C61020CC2A9DC9EA7278F8CFD1246E32B7678232AB526F10B8212B919AB532ED8645AFC5
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..!R.P....\....a.|e..@2..4.L.....#+j...RQ......0S..b......ioI...?..d.FVS2r1I..U0...j.L...d...L..Y.#.Eu..LMr,....|...[..d...L...d5.&1.j..3.Wf........._..a7.@._...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-soft_95_ffedad_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):409
                                        Entropy (8bit):6.56783434179835
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+B6lGW5jfTO/Z2zS+E3V+2EMiVw9:no19+wlG6TO/IzjE82EMr
                                        MD5:6CFD2E60683A1938A11922AA839984A1
                                        SHA1:0AA783ADF35C4A21C3980B0832D4A57AD12CE791
                                        SHA-256:7F08CA7830A2468315EAFB1E1E23625A2F9BA3CEB1FE0A17B773A9B2424036CD
                                        SHA-512:698832C8E9DD14107F73022D50EE41E8200850832C3E5E5457E3CE39C5BD8F858DE4AC4E9AA5E9A1D1CAD28AD3C2F07233E6AD0BAD1AE4F1C6318DE49EC53FB5
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..p.G_>..f.....q.ghz.J.@g[.Z:X....ER..............!=z.....pf.T...|..u.............C.!.v......dSC*:..).,.Hyc..h..#]....<7B.T..g!r..o9..@.....x.T.T........%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_inset-soft_15_2b2922_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):380
                                        Entropy (8bit):6.461070348423757
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EBFmBGSxK2P+YaOsfc6EWU10R9mJ2zgN+E3VKF2EMiVAVTp:6v/7WogU9+A7s2P+IMc6EWU1pJ2zS+Eb
                                        MD5:F81024672586DCD00BB1EFE5CE5609CC
                                        SHA1:3CA80356A781540FC0E9A168E7E7CE093D7B0567
                                        SHA-256:E92AB30319BF5F5D1437C3517CBEB51E3BE4AFAC9A53C304851A2DF3DB0BE253
                                        SHA-512:D0A04C41EE7ECC50AFE39417EE45E59CC6661B1B2E3BD7A2EB5CDC09DA664C0876EC18AF31EDB1A87A93BD2922085C73964256F17A0AC49361B2C425DEBC7821
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....P....1.B.0..9..9...xb......h........$...\t.Mm8.*.F=4...h.o.3r.i%.,Fd.............d...s[.:1....1(.N....V..?v....#r4.g....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_808080_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7117
                                        Entropy (8bit):7.923945259207644
                                        Encrypted:false
                                        SSDEEP:192:Y+Ud8y7auSvSbMkhRFHMcYkFPrj+0YLE1WXE4e:Y+gb/XHMtkBjMn+
                                        MD5:FDF6299906487D9970ED37DD84E67250
                                        SHA1:49DD01B6D573B340DEA80743DC5F32BAD5CFA1A4
                                        SHA-256:C89F549E41DF136A408D650F9517186F62D5418F00955B32667A0DCBED415FBE
                                        SHA-512:4DCD2D48B6A4F14EA3CB024FFD4CB90C43B6360A2CD3723A98FEC910244048B394647068640B1F9EBD3A041A073DD2A026E20CF29093BF381E1D7C916359674E
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..G5......tIME.....%...'E....IDATx..{.eE}.?.L(bX.1..[R.`...J.H..E.M.b...F...h....P..... ....XT.#.D.T.;"ba.Rqv}.......G...)b.....}N..9..sO....s..Ow.~.8........d.1..x..^.../.2..........m...&.@..`..MX9.2....$)...=.,...0L.L...}.0~z[.....J...%..S.#.G....po....I;,.:q! `.X! 0.\..C...."&.@....#"J'..?ie......k.2n"d=...t.......&..S..6MC..r.~f....0."S..*.j..`n....,e[?.....1l..WM.......+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q....F.{.7...2.m..0?..:..vux.....r..n.0s....Ws.....s...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.llc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.......E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U"..R.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....7

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_847e71_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.776257661253038
                                        Encrypted:false
                                        SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                        MD5:0F6217A6D8C5FA6182B2D3B0CE5BA27A
                                        SHA1:8E8369E95B0C69B840B823E0C10C98781A1830F9
                                        SHA-256:9E5F817E9290D81C7E075704163A57B9F3D8BF68C474F81535AFF71762F4E8F7
                                        SHA-512:2C7141DBDCBA9F63EB3AB74D505B773B84220C83C39EA652522C16BE5730F2CC537EA4F29FAC386B85E48FFCA7A04F6135B30E8B364B0B6D58CCF6E902882C08
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_8DC262_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.775872077303001
                                        Encrypted:false
                                        SSDEEP:96:JNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:RHm231Nvu+wIqltWOe3nIP
                                        MD5:AEA745F96521B224FFEFE0B09A2B51D3
                                        SHA1:FDCC8D416A78574B8046355B3F6DC59E9F0716D1
                                        SHA-256:001DAB314ABC06451A9DB2484608E8F1AF9C37597D66550FF7B04DB531D1CF65
                                        SHA-512:0195425A8CA501A9B10046C3E783515063FFC2ED73ED25B42AA5B66CC4C169D1AA7E6B26A5F0D63C3367E78F4BDB795CF4BCE6ADAB61425C970BD793DDB77144
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..0....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_eeeeee_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7010
                                        Entropy (8bit):7.937028775954862
                                        Encrypted:false
                                        SSDEEP:192:alNgJh1aEbYK0aRv2Tt6sqvaZ6t939Teulhv8CVL:aotbbYK0aRvsnFZ6f39Tei88
                                        MD5:53E268DFFFD69B4C3A204488A93F331D
                                        SHA1:5CB0300B3020FC197603F8AF8F1B0674EA673D84
                                        SHA-256:0B71B6FF77D7DE81E242DF3EF02FEEDBEDD52B8642B0DC9EF5BC9E5477414BA1
                                        SHA-512:6D587F179A8F01E49CE7B258AAF60207E6B2A1154DBEAEBD68CAD2B905ED54CECACBA0D1D5B311B08CDD893F2AF6E603DE1048D797A498949BE769785469C440
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...?.M....tIME.....%...'E...EIDATx..m...y..c.Z.....c.......BR)....6.bz.H...I.i.z.w.......P.-...z.6MR,...U.X.b;).n..XCc..8.*.......63..{..W..w.s.9...9.s.....:cE.+..[8....."..4{]...#@.M.:Q......../.s....Q....B$.....?.L..:.....Lc:w..rW...>......#...D...B.Q..>,.*y..c.....\....^<..]bt...C.y....J..2..M..+..d.5.#$=.......4....u*.R....A..3}...L.....I...w.%..M}..}`R...YV(N.=..7M......AQ.......X.h27H.5....p3.5.#@...Ps8.....5.#@...Ps8..l.^...Q....#.d.ij...g0...?.....}.HR......oB...)..mR.............P.G.t.6.....@W;............ ..b....1.6.....nj..Fo."gZ.(c...\...@G.S..].3.k......../1.9..p.A5.#@...Ps8.....5.#@...Ps..........W.+-\..e.J#.......MA.=.rq..Ak......E.s......b&G..vW`..@..B...{.....Y4..%..c.M.<.L.,v.Hbn.......r..&....l/_.cn$......D.F.*5...T.>..,.......N.N...k.A.@...1..ag.{.N..E.:..[..t..M..6....&].M*.L...../....u.;.tv...0S.,.jP....:.=.z..L...i

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36786
                                        Entropy (8bit):5.282160205211848
                                        Encrypted:false
                                        SSDEEP:192:10OW0sRdX0Zb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC76:ydeb/+vaW1e07PddF5fyfEvDS25/
                                        MD5:5F3CE6A81EE8FE565088287F643091F8
                                        SHA1:FC9505428703E02CDEDCADA79F4812EB27E1F257
                                        SHA-256:8C736B0D1F47B29FA98FC10CC4F2F07543441E9F23E987B1484C7146635AB17F
                                        SHA-512:73576139BB8D465F1D25676ACF9843DAF4E07C82F0C96A185F57638D22BA8ADFC8DA2F0C6BA4625C4C160A2FE93CA9D3F2B598A5F8B37D00011B64680B89F291
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacity

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29738)
                                        Category:dropped
                                        Size (bytes):31569
                                        Entropy (8bit):5.226827075703083
                                        Encrypted:false
                                        SSDEEP:384:ydelcR8lOXHc11evx0zkmc+4i6GpaD/Sc7nfZBhVE:2XHcEx0z14i6GpaDRBhW
                                        MD5:214251BCC995B04AB7591B5A91F3D613
                                        SHA1:CF0BDD7C7A728BA85F0D09B3CBB32E63DDDEBA24
                                        SHA-256:FFCC4681C57A329F5F15ADAEDA52D839660D96E09DAC712F05F8B0869903FC9B
                                        SHA-512:EA793B66A6F7170DC52325FAD5A2834A7AECD2BFCC69F98F053666536A4AC2413AE9945EB758B96C4F6C7B88FE3E73CE85A836ED3EAD407C54A7BA21F91785BF
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacity

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1408)
                                        Category:dropped
                                        Size (bytes):18132
                                        Entropy (8bit):5.089714022844099
                                        Encrypted:false
                                        SSDEEP:192:XmRdX0i77gndVjE5YF5fy2RCcNeeqEcY9pn0NygmB0iBfT9RhS2wV53skuMaaSQm:XEdAddF5fyfEvDS25/
                                        MD5:7E69CD2743CA2896690D9FBB1E119318
                                        SHA1:CBA6CA6BA67596D14070FD4EBAD98F2B3DCEC4A5
                                        SHA-256:319040E0E34436F99396573380A1BC08955AFFED065F37A49FAFC9E72F240CF0
                                        SHA-512:9A2F7535D8B664D9A3B5FDDAEA9965503B43648544C498A17AECD5D1103149F6FFD06CEB51BC5E649C002CD2890D43AA4F51FE6D5B744313F3E958A329D8D0C6
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacityHover=25&borderColorHover=327E04&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=fafaf4&bgTextureActive=highlight_h

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_45_0078ae_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):403
                                        Entropy (8bit):6.549410477715596
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+YLvWMP4m/a1sPzS+Em63KEMlOX:krr9+YLvWL31sPzjEmdEMlOX
                                        MD5:05B4189C61CAD5711E124518CB55D11E
                                        SHA1:B4CA6A3F981478FBEA4D1E40EB8F0F5BA5B2FA5F
                                        SHA-256:59CEBFCF759B6B7ED33FD4CE165223F8895C090CD2D943F11D6F582E50FEF05C
                                        SHA-512:0D820891E083DE8A41C3D0CF5797D6D3015613F43C1F401AE53C7B69F47D99B1FE019213A275469760E18029B4E2DACF4AECA7B4E34D5EA55A8D503CE3AE66A5
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.c...pwo .......(5J.R..(Es....?.21.g..8..E.I...+.....L.?..1Mab{.,.t...>...]&.`.H&&&.`.H&f..]..=&.....;.X.0/d..."......1....c1.......(5J.R...Q...#........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_55_f8da4e_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):403
                                        Entropy (8bit):6.460562824701208
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Y0gs2gttFr59GnHPvlKiavzS+Em63KEMlOX:krr9+Y0gs2Kh96havzjEmdEMlOX
                                        MD5:67E15B90051B76936D9FE904E4B1B972
                                        SHA1:D66C7D1C33D1CB0DAA6B3D0F79592D63818BCD24
                                        SHA-256:4E393510798CBCC6746684F6C0092651FB59AB9922C475D91F4C50C92A932893
                                        SHA-512:563E145B572369C7B18774379A95DD745DE4FB3D27B0FD12470C558F930FD0BE2718ECF907215F255A91F115A0D86F1FDBE672FF3CE7CB628CCBAB68A16A70AA
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...1..`....}....,.&..J$mR.!q....T'.K....I.1aq.B.q.a..g~.Z_.b!....0...^>.....S.R...\...w....B..WB...b..O..Q0.R6}%$.]-.x..1........\i,8.0...a........%......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_75_79c9ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):6.591491659482794
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+ydFO8FSF2FrzS+Em63KEMlOX:krr9+ikyzjEmdEMlOX
                                        MD5:91B2A996DF0F598E2C3256D1BBBAEFC1
                                        SHA1:9CA8B4C79EE52D4CA3F3158068DCB861B0F9AE68
                                        SHA-256:20DB51643CC06CF91D7E2D76504D0669D3A793FB9B90C1CCF248C72E8B0F1AED
                                        SHA-512:518C362686DAE2743C79E44F37C6D3B565B21B533FB48FB29F4634A7EC986203149387DEE6B390000092C74F84BE7121A7456208ADAC78BC1F3E2854BDEC5573
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....`...s...Ddf..^...;0,Y.^.qE.`..,.l...u...A....5../=.........a...u.....I+n.Sm......\(HT"S.+b!.Q..\..+......O... w..;..Jf..oM.&...St...i.0..../."...+...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_45_e14f1c_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5922
                                        Entropy (8bit):7.68968045947838
                                        Encrypted:false
                                        SSDEEP:96:fH3oGRMuCB+5wSTTJCCK1iycpnINYXYOT5TgudhYYz+7qazYaLhIAKg:P3oaMuUST759/T5TgqhYW01zpO5g
                                        MD5:1B850EED5228F446BDCA7FFCDA647EE8
                                        SHA1:8FB9F3FC3BF58564F5C752972C6F53846F281FE9
                                        SHA-256:66CBB2F82EE5CF5C1386AE154D925F3B4481CA52671E98CB15CF050F8129BD84
                                        SHA-512:9272E8C34CE6BEC23062FA5CAB0F4A59E0A34E62918FFF2210CE9FE564C92CB6BDA0C8D4AFF7D4F2C2384974DFA1C4E09E8EBD19F9BF9809E111B585E8756748
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...&IDATx.._.e.]..>..>.{I.e 05j.1c..A.!.j..&.. %.i...Z...,.4..P1!...i@..m.......6..4>t......Z...=w..ot.Y.~......3.|.............W.....{/<........XaF.v......n..w.....5..;.............`..........pp.....X.8........................k..w.....5..;.............`..........pp.....X.8........................k......&7i..S}..K,..)....>)...yj....W..BI...-.\....;..5=..x..*.)1..T*-o5......SW....U,xc.b.+..k..d-......(..[{C_-.'.+P.g^.{.5y...l...X..J,%....<c...?..=........B.<*3m....?W......,W..oJK|u..\...c..(=..-&....[5^..s-..k.a..U......^..K4.....G.j....N...-%+4...U=Syw......{-.y...7o....~...d.........Y.[........o......X.8.........0.{.$l..f...=...........I..(?.y..*..=......#.].ev....>.5.N.....[...V..YV.+k.....j.=..]..nJU..){.R-...........F.W..N....=.......d.K...~.J.Wyy.F..Yr.+.l^.)%.\D..k.......lv..]S;k..K.....~.>..}.....e..8...ym..ymR.)..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_50_6eac2c_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5964
                                        Entropy (8bit):7.6902055019466475
                                        Encrypted:false
                                        SSDEEP:96:fHORrlGaNFuGTEqceljT7JUI65e/MFuN7i7OlGRufe/95ZCsCfXyRT8x:PCrMaN4GgqceZT9uM0RGGRuW/953VO
                                        MD5:879551094DE8697DF488B81F917ABD54
                                        SHA1:AF147D410236C3C09F1312782916480FC6A5EB57
                                        SHA-256:D893CA2B0E379858C35368EB8892CABA6BF504F038491847CC7EBE0D97C90717
                                        SHA-512:A55A54E59615BAADF46EDAB3ECFF3BC4E22A2703A2F266378329F47244CEB7636E100FEB5BA6B18C10EE1DD3AECDB700AEEFE852A8B8C15CAB1E99B0B0F16FC5
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...PIDATx..O.e.U..^?.....o. f..m.%@D$...-.,..QBPb.....i$.@....6,.O..#$.$H....~.D.8d..b..xf... YHl.b..eq...TW..T....-.N.S....5..../^...=........3Y.......p<.......V........+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8............n.m......g/..n.Y.E...y...S#o.<.:.-.d....Q..H.e..g....YE1%F=.J..r.V..r......k,}.}e.r..z...}.Q.b.C...Xk..%..r.J..p.&..Q..<V...K..c.#../....~...P.....`.,...7......@]Ob..,W..oJKxu.y.&.i..Ve.......r..........ZuXbm........K.~..y{x]....X.....S7.zK....}U.T..duX#J....<.Z....^..O}..L........f.v..e.......)x...............`......l..;.7.]i.C..Q.];.>..4.Y....<.bZ..L..+..HG.G.].!.m..nM....+%.Vb....w.....I....S5..G.[K7.*b.=P......]^....Z#...^......}....0Y..w...b.U^^..Y{...J2..cLI%..(..z....fn..i.mG[b............l..F..<6oZ....%.....k

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_75_2191c0_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):6035
                                        Entropy (8bit):7.688210298202852
                                        Encrypted:false
                                        SSDEEP:96:fHN3nrvlGl8UwCW1o/D4PgnYpjkNaSdq9nyuWrJWHcpfO4nWFR4Aq0p8Y40tZYkW:P1vMrw5MvImawqFQJW8dC+Aq0piV6v+
                                        MD5:7DB7584F3F7ED73A0588F5B7A4FF3254
                                        SHA1:0EF2E09C002050070F365E43E0C51032D9032337
                                        SHA-256:B75E9EAE369B4E83401F6FF941BBD69C7D89C65243AFF1F66F5BBC816E84EE5E
                                        SHA-512:6BC3F617041C9670C979596C5A0E8C68B0FD896B1635A780C3596B9648E434D216D44B10ABD9B80DDD26E9D349D2A46113CE7DBE4E98066006393601896CE28C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..O.d.u...k.d"#..D."b..e.78...'..$.".,z&..e1..%...l%.a.)...Q$3D1..=i.8.c..%...7^.A..i.H0,.lx....>;w.W5.SU..6|....V.:.wN.-x.o7_?....U.......f.l........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........\...n.m.[..X...%...1....>1...yj....U.....[.[..2J_.....Z.U2.(..gS....TN.*.Z.].V.>V.`......R..U....6J^.{...._.N...j.=.\..=.*.z...G..o=.....R..X..36_...'..B^........,....[n{.C..'1k.Y....7.%.:../&.i..Ve....-&....[5V..s-..k.a..!.S.f^..f/Y.%....uu..b5\...N...-%+4...U=Syw...a.(}7.Z...j9ho.v.......d......................2.....+..w......`.z......^..............I...EoQ>.y..*.gzv]g]I%Gz...(.+>....)u..`...J,.....b_Y#.Q..y.....h.uk.TE...*.R^]y...o]..XkDy.`....].....q.\L......SPl...5:k..\If.b.)..b.Q...//.._.Y3q...~.....C...t.w-.3.m.,[-.Q.<...!=o

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_inset-hard_100_fcfdfd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):350
                                        Entropy (8bit):6.206000010177241
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5Em3MFQ3fK3B6tTLpM52zgN+Em6hp/KEMlOZp:6v/7WogU9+C0MtTLJzS+Em63KEMlOX
                                        MD5:63B926C3D199D7774678EC2F1CFEB44A
                                        SHA1:60483976063220F6BFC4508287E98522312EE277
                                        SHA-256:0AE17677A06192D5114347DE45ED6C6F2C3A660C1202AA6EA44E12BFCE7AFE5D
                                        SHA-512:7BE4D05ACD6519F4892F63C0D8F31E4AA6DC3DAA0467B9F93F2B3C3653A87C1CFCEFD267BA03A137EB110C7197F526ED8A03C227ACEB06D2F63787708F103AEE
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...bIDAT(...1..0....`.JE... (z....BHm.......u....~..5w}."....^,..bcb.$..A"..H...V.A,npC...xQ!T..ry.D...H{*1...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_0078ae_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739187429694133
                                        Encrypted:false
                                        SSDEEP:96:pNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:xHm231Nvu+wIqltWOe3nIP
                                        MD5:C2A2DFF552EE2D63B9B12861425DA8E4
                                        SHA1:A50A98BE703E23E4D1FF74752984DB7064E87E49
                                        SHA-256:98A221399F8D3673872C94EF3178D43597713A821C92F5EBF5135CADE0F70B84
                                        SHA-512:67FB2556D393527FE8AA482A67DF36470B081904EFF37BFE2783AE6D1A8433B01AC20AAA55821B5405E480F1F162DFC6B145B1C1A7FA51E0D7BC7E355B1DE387
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x...R0...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_056b93_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.778670676983036
                                        Encrypted:false
                                        SSDEEP:96:zNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:DHm231Nvu+wIqltWOe3nIP
                                        MD5:CB52FFFA4237276F016F7180CA1C1B8A
                                        SHA1:F930726B7A6A37A4956E4F732B6FE3869646D705
                                        SHA-256:68351A21A09C652481AFAC4962544010A86F5BF4314C5F90723BE35110EF9424
                                        SHA-512:CEF74AF1812ECA1C2FB551E204D8E81122DBC638E9799D54CB3AD642C4CE3483AABCC652175E245FA1BF3A07CFD0EF0FE577D3E2B0A5D86DA7E606F652363C58
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_d8e7f3_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773667817462664
                                        Encrypted:false
                                        SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                        MD5:06F311C437236B376B247382BF815C71
                                        SHA1:110DB3851E725E1CD30D73D292201A6699344E4F
                                        SHA-256:061647E5266E0E229DEAC8AAA16D839EE64DA5C0E7B972948DAC3D071D27F547
                                        SHA-512:C90F60977BCEBDA00CE1D77748A3E2C4F53D9526B867537143D3137E4134858F2C02D45F5521699EE0EAFF6AE4D54C4217714D75E902D89D45EB8826ED51D7A0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................e....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_e0fdff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.755367374553932
                                        Encrypted:false
                                        SSDEEP:96:uNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:gHm231Nvu+wIqltWOe3nIP
                                        MD5:91403D8B6F91E344BB6E344D26CD51B1
                                        SHA1:2280A7E734CF7A259F1BA9201D27AF6A4C4E9F16
                                        SHA-256:98B45E794E837E483E570BBEE898F2049D4C1DDDBFDA479A9C9F613D3840E24D
                                        SHA-512:7F4E5C3D06FEBA1BCE4272FB915A6DA14BE80EC9A7D72C69B1CFC92E6A73F0A0B22CBABA9CAA038EF194B090DE2711435BD8DE78318B4972CFB3325D62C5F754
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................q......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_f5e175_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.768313863902363
                                        Encrypted:false
                                        SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                        MD5:4541A85EDE9D67D454B0D0039EF8728E
                                        SHA1:7B51B7204AEAB4AE63FF354EDAE3BB2F8AC107DA
                                        SHA-256:38876FA7B854610BA82FC9D6C03941E79C5C28ADC7BCEA89B99BD2E0F26C3234
                                        SHA-512:9EEECAD2896A1A68D2C95ACF9D88A44ACE50BBEB1F26F64C1171DBA95B67528F81E7D890DC6C35B0C8F703282B8E1122F7D189EE1C7990B24434BDB426FA37E9
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..um......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_f7a50d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.77507517756097
                                        Encrypted:false
                                        SSDEEP:96:wNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                        MD5:64EC6FBEDFFE32AFBB48E5AA85BF086E
                                        SHA1:38844861F9CC3A3CD0C9780CDB75430BA7BCB6B1
                                        SHA-256:5C33DD220D270E399752CB32BAFEDBCC89AF5019A6D921436796AED89057BDD7
                                        SHA-512:C8A092A76E64FE2AAC4560DFF007F036C20C11DBCED03372BE80207BE9F7DC3A08297F72AE2E51CAC99B66DA5C22BCB71E64C9CBB051F92B3EE82E1FF0F8C968
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................n......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_fcd113_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773382235778011
                                        Encrypted:false
                                        SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                        MD5:BBA8336D01DF6BBDB30678452364950F
                                        SHA1:2031FFC7B941B7F7AD9CA0179FD4506174D0F57A
                                        SHA-256:167523F77EEAD492792DFBF71392EF5C0D3D09BC564F7087B756C7CB2A10ADC9
                                        SHA-512:19D4F385CB920D227547BC6850C33A54078EC7A82858644D762CC88C4A58B2B940C53089C73F423D186690DBEC2E2CD4CEE07B43AB06E10150FA5F6EBD373C76
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................P\;....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36629
                                        Entropy (8bit):5.281302252210388
                                        Encrypted:false
                                        SSDEEP:192:10OW0gu02b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHlnA0G:cJ2b/+vaW1e07pF5fycE2xDS25Vc6Kv/
                                        MD5:27CF8B6EDE40F8C30CC8280B7ACE0782
                                        SHA1:82E878D033753893ABBDBB9DB871DD2E2A0A61F2
                                        SHA-256:187EB517154BBD2784CEE91F411F0E7147C894240B9667A7B4540C2E8E2D9231
                                        SHA-512:03574345B653979597C0E96407350FB5B97DBA996B56A44C21366551476761EBD9AB52A25396A724E04C320FC50F28459050B2F2708E3640468CED7BC7884958
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29611)
                                        Category:dropped
                                        Size (bytes):31387
                                        Entropy (8bit):5.224818221402447
                                        Encrypted:false
                                        SSDEEP:384:cJ2lcR8lOXHc11evj9zRmaG+4Q6G8sjy0Sc7nfZBhVBE:MBXHcEj9zMaeQ6G8sjpBhA
                                        MD5:7FE6AB79E159819A4DB99D24B79D7EA5
                                        SHA1:611FE487009CD7FD815854F29F49197E81F9EAE6
                                        SHA-256:F80A56801FEB59155E1917A23B35155E43D7233CE28087565AC1D04A799A744E
                                        SHA-512:2831924AD6BB21A61FC1B72F5836111791E978368539AC78B3F67CB20408C380A823A7C10284E8D3B47804E7C68A516340F3DC997965EAC960F1BAC55261827D
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1353)
                                        Category:dropped
                                        Size (bytes):17975
                                        Entropy (8bit):5.088177344743783
                                        Encrypted:false
                                        SSDEEP:192:X6u0OnA0vTF5fyh+MuEcrYu5wK/lgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6C:X6J4F5fycE2xDS25Vc6Kv/
                                        MD5:8BA00131EEF33D92C25C87E22E083D54
                                        SHA1:64AD37E5B12A6EB6A4C08873DE00ED3929621041
                                        SHA-256:58EF3F583F08153750829DC6962A083C933DAD72FD1FC62D8A837FCEBD7A445E
                                        SHA-512:04F83B486E52B4D2A10DE05F5D5C788CB8B798A536A39F043B73E9FD95143FC6D7B5BA8D63DC41E1E211EA1D17CB77EF00C81EB573D98B11473D61988A2C0E6B
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=448dae&fcHover=026890&iconColorHover=056b93&bgColorActive=6eac2c&bgTextureActive=gloss_wave&bgImgOpacityActive=50&bo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_diagonals-medium_20_d34d17_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):440
                                        Entropy (8bit):6.645254076771535
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+iX1+CeVOOinRVMK7bweuRzZ2zS+Em63KEMlOX:X9+esCeVhYjbwegzZ2zjEmdEMlOX
                                        MD5:8CB63B9E938439068BAD2D541649EBC2
                                        SHA1:2832B94E06C2B4F755BEA3925198CE3C04587C14
                                        SHA-256:B44DB4293067191805F55154111AEDB6568AFE4D3B98C491500353BC90D7F83B
                                        SHA-512:45DEA1136F5F8280126773543A14CCF5EF20033A9AB17CA2C7C6F0020D256CD7F4F716A206780B01EF9C154E693588F53D2EA8170B9160D1AA3E2707FE80C15B
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATh....@......J.Jp.F.n...P..K-818v..l.[...a.l....OK.......v..k......:*9|.Q..J....k..o.&.uTr.....G..<..Q.x:.N..0.nt.I].....a.u...>..O.}.5....k<..Q.x:..t.G].....a.u...>.....%..1;b....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_45_817865_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5939
                                        Entropy (8bit):7.703846412692604
                                        Encrypted:false
                                        SSDEEP:96:fH63ESQseVGhA91gbMzgDtdz0RLPgSAmP0FtHx3IV5P3qGoDOEJ3yitdPKs:PMGGhgcrKLPZgtRYVJ6Go6E0itdPV
                                        MD5:4234E7CD58DE5D96A698A6EDCDE2A445
                                        SHA1:3E382B5328B7E2FE57D0970EC85215C36A3CEF7F
                                        SHA-256:CF05534B9CFE492367271847D6BB9BFA8C4100409FB0E680EBE3B5FED82C06A3
                                        SHA-512:1BA199160873B686F1D4EF50F1C9296591D9FA747F58A0FFDABE49B6730358352556F2402D01F4EC8443FAC297C12F048AB972F0F7076F9F7B34D041DE2917B3
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...7IDATx..O.e.u..^.MD.)J28.L.c..V....).& Y.,C."d.-cGa.3H1..Ht..h@...8.!......(.i{.b%.Xe..IH...d...{..=.m.......}.}.xS...9.S...{.w>....p].......3[.......p<................k..w.....5..;.............`..........pp.....X.8........................k..w.....5..;.............`..........pp.....X.8............a..xL.^..c.^b..OYHE=...P...F^.y.yu.-.d....V.....Z.3.W......Me...r.f..r.w..m...X..J/.Zy.,...j....(.{.........7.{M.}="..<V...K...#...s.[.~.rf............v?.u.]...glkv/.U..R2.:../'...^e..v....r........9.k...kS......^2.K4.[...F..p.......KJfh..z..v.........<.Z...W....._+........c..a".A.......<U.....`.............p......x...|HW.._.o'Ugh.&.^.|..*.UJO.w]g]I%G:.>J..)o....q...d..X.o...e.2G.Vz.y.....]uk...5e.TFK....]^}....F.7..k......ul..q9Y..w...R.U^^..yk...J2..cJI%..V......}..a3l......S%.{.......-.=.6S....Q.<O.k.`.k..N.V.].;.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_60_fece2f_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5908
                                        Entropy (8bit):7.679038274873359
                                        Encrypted:false
                                        SSDEEP:96:fHC5G5GhcMdQkz/dUbvU7FS6fzEsCWIz+tpuYkEpCMqsqZ/xDIeG:PLqZZ1UbvUNrEOIzipuYQMqsqp7G
                                        MD5:B694AF5933744F277DD773B99D56D983
                                        SHA1:95B543C087CBFEA02824F1DE7EF0A6447EC4B02E
                                        SHA-256:1815DC24733A0B93B2B07882C2EE13CE20FF1AF7826CD8B2CE514B18D2DEE289
                                        SHA-512:8FC7200B582F9395F3392F251910CAF52FE473CECFC543B315F0C8EC09EBD6BFADEE4E65C0B3CA0F9744D98F199FA9006833A014BE155BA318420E8F1A5B7BB2
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx...m.U.kw...m,.-.!..J@...".E0b...Jp.#.?...dY2..n#..B.".]OA !.!....%v...l..'..H(r"..v1......UU.<..o`.kW.Z..u.9{.!....|.,.........n.......j8......l.................[..w.....-..;.............`..........pp.......8......l.................[..w.....-..;.............`..........pp........>....W...V.....~.e....cy..S...:.:..Z...o..J+}^.qE...dVQL.Q.2..fS;u. j....z[.B4.9..K.VQ=[...v.V}.....9.......F..;.(........G.EU%...'ZG.q..._...P.....`.D~*..I:...M..'.5......M)).nB.W.k_..mT.........|.&.a..U..^...&...f]..zo..-...}u.[..1..o.o~....Z.|....evD#.w.:O....!..{....A&.......EJ.8o.'......`.Se..............[......../\.~&?......v|.^....:.,.,=..u.u%.....(.+>X....q....e..X.o..e.2G.Vz.u.Z.y....tSF.eMY....>..rWW?:.....Ct......3...?.&.Q.N\S.S..^..%.].f.Y.%.u1ZJ*.Xrs....K...t0\.[.8.0K..9w...i....G.e9j............./.N.W.].?..V.JJ,..V

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_70_ffdd57_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5601
                                        Entropy (8bit):7.678761754017709
                                        Encrypted:false
                                        SSDEEP:96:fHShn55j57kHjG/x0dirogumOBa28bPs/5+HzRCnvf/+gbWof1ohKv0d:PS/H4C2EULBesh+0vnt1dowG
                                        MD5:2870BD72CE344FA1230B5290271568CE
                                        SHA1:356C051587C717C55F0752EB04C116C886EAE6D4
                                        SHA-256:F50F4BF5792D6EB30A71F9FFCC309CEC9B3B3631E07B5CBACA041744D19E274A
                                        SHA-512:0BF4113C3DC4C8AB4C88258544B7A22D9042E209F8AC518689EF705ACF9366786327B402C7A8FCF19BD17BD09B7D32496FDD5D82D04462FE556FDC6532876AE9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..M.&.u...|..d!.L.&...L.x..1.E@B".d.@l)..H6......Bf@.0.!..v6.....$.!9....3....3.;..-C..T.=?.[..}O....G..]uW.:.....z.....w.........};......g.......`.0p..............6..w.............`.0p..............6..w.............`.0p..............6..w.............`.0p..............6..w......p...(_9.~....=b.>^.P..LS.P..F[.m.yu.-DJ.[.....va....7^.d.....TjZ[k......kg.5_.V...e.......g.-.mG..o....b...{b\..[..m..E......(>GTUb..?.4b.C.....l.........7U.(]~.....I...~.....)...)k[..Z.2JJ...)....Z.WCo^K..^.0bm.....V.m.G.~D.>...m}T.......-_.H...1_...T..*.:...ws..6O..O..r..O_...2......L..>........v...............6....~...8W.&?..^5M9.SKS....Q.n.UMO;w]g]I..tt}....j....z...%R."..kA..S.JY.....*=.6Uk....u{...5.....v..][zo....F.V..}.~.k.{z..9........}.T......7ed,.)..kJ*eq...?..[)..a.(_6......P).I...=G.f..B.E..Z...v.6....{....B.JQI.EQ...R..J

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_90_fff9e5_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5447
                                        Entropy (8bit):7.6937201144293565
                                        Encrypted:false
                                        SSDEEP:96:fHnk+vTQEKQfBNA2Wlv++M0T2H2NqH4+tJcHYWfUSG9jWmHpY9LOu+La0jQu5tB:Pnjv3DA2+mHWs42jWfw9VEqtLa0jD5tB
                                        MD5:921941A5B2B71FD18A9CA66102B79113
                                        SHA1:C079ECFF626806411093802AEA83D74B4E7D8FFD
                                        SHA-256:39BE850DB2EAF01CC65CC9E3D1CDB664211CD0B34AFFF7A563008EB9B284C500
                                        SHA-512:AA1236FCDB32CC5E7AC6B18E5F9FBFAC6C565BAA4711C91D44BCED650C700434A595F3A97F3BCEEEADC5D85EEF0BBB4FA4D6C1FA7F81E6726B16268572E3C23A
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...KIDATx....%G...j.3.7...........A].F..Q.U KW..EV..\..\(...q#(.R..0 ..(.B......"x.r...[S.}.z..tO..E...z.....N.)...7......l.{........q..............p..............p..............p..............p..............p..............p..............p..............\}.~.N.\./..c..).^^+...r.Z.J.m.h..-c.<.%Dz....+[.....oiz.z....1..zo*#.mo.k...%.>..|}[..o[F..J-.\y.......]..U.1..V...F.....z.o..Q2....[m.}..#YU..9.x..k.r>...mn*...............o$...Z...ol...-..:}mg....eM....x....o..u.9.{..Hi[.O.2........y.1.o..Q.1.....o..K"{h.q.U....V....".l.-.-.o..O9....uI.....ANRJg.......`.2.....p.......Izg......j...5.[-.\.S[.,.V.E_...-.Z.j..k..gR.#....v%.Z.e~..q.....o....A..Km.....#.Vz.mY....{..7eT.JS...,..]m}..w......m<x.u......=..8?...^mW\K.UP.x../..y.\.Ez....L*}./....'SJ...K.Y.%.9....../K.k....-.lE-.Z.v..zm..)..ZG...J..,)mQ2Y.W..m..d...";.Z9J.){..1..%?#J...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_highlight-soft_100_feeebd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):401
                                        Entropy (8bit):6.547463981344383
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+4hdiSjdOBdKfzS+Em63KEMlOX:no19+Ei5+fzjEmdEMlOX
                                        MD5:7385E960B273254918C00B999D211F03
                                        SHA1:5ADE46E5B00248C7E0BF6392E90AEEB192308D36
                                        SHA-256:CC61DC20EBADB222C6D6AA6395448F53442159CC122CAEB14863426DBBE493AF
                                        SHA-512:07DD8A4FF7A1FC7B7BE4D79756D1C180D55EDD2E4163C66E964462AF6AB1757B4B156C3E383688F68D49C1B70EAC1A82A469BD52140143B9F43C0BFCD3D3486C
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(..1..P...w.O`..'.....o GPJ.L.........W....d..-.m..2......cP.Kc`.*.4z.>1.k..N.b..........F.t..6t..~....i39..^....B....x...4..._.q<...\.......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_inset-soft_30_ffffff_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):261
                                        Entropy (8bit):5.51952304670403
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPQUyKO0kMhgyOTd2zgN+Em6hp/KEMlOZp:6v/7oU0g+YzS+Em63KEMlOX
                                        MD5:A02AF3EBADC6530042FD793EF06FCC45
                                        SHA1:7EED4D830D533DF011FFDCA7D421724E2DE6DEE7
                                        SHA-256:773332AA0C96DCE46525C2D1A445C2F9031735ED8FC46D149C754984CB7C337D
                                        SHA-512:B77F6A70CB772C852E802113BF63F034A656DC70E5A7843E005419935360C73B05F003C2A90060FB665F48D1098EA09C04FF3BEA6ECA8B668D6CD34FA0E6E0B3
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....oWg.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT..ch`......2.j<z....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_3d3d3d_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7074
                                        Entropy (8bit):7.919346283987806
                                        Encrypted:false
                                        SSDEEP:96:0b5ACzsCSZcc1XFvamelC3AHKBQtP+yuu1GCntG1pJiwIqRWiqc9ed9G+k2Io:Q4CQlnH2ldGCpoRzqcAez29
                                        MD5:18BD9AE0A3BCC97841BF36D515B90AC4
                                        SHA1:D54C01803D23762E08554CC6075518B2CAABF4D7
                                        SHA-256:098A92099477A79D3EDFBF2F0875D2485704690BF2A34FD14000EE00AFAE01D3
                                        SHA-512:6A3FFD1B00304C37B5756FAE282113E204638AC687A021D52FB602B15B8E5586AC7AA74B8F0CE03F85167FAB78B0B02D3CCBA01720FDA280E61AAE0FAFC9B706
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.=..o#....tIME.....%...'E....IDATx..{.eE}.?.H(cX.!..[R.`.Tv.*.J."wL.&j...XA.d.h....Hf..Yq.h...v)0.U...Q.U.P..@.].!&.........".........s..;s.;u.{~.}............&.Ag.c....px...&.=.L.'..d.f.Xj...Z...~..c..{.@.....C..`......[........al..X.......R.D}DV.z...B.7n..Q'...,.......q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3d.J...[.....Z...S0.Ms..}`.....P(/.f....6K...<..)...=D..`....fb..^......px.h8..4.^.../........@.....q...uF.{.7...2.m..0?..:..vu......r..n.0s....Gs.....r...7.5@..@@....2...t[l.{.S..O..7#...7.d{...e.^@...>]..L..-oz.....e..!PE.dR...=.I.l.O\r..6`.S..`.._gxup....../........@........px.h8..t.....W................. {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_bd7b00_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.742716878205026
                                        Encrypted:false
                                        SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                        MD5:58C547F99E4570568CD2952820C60BAA
                                        SHA1:CAECBBDAC9FD46026BC49836C7904F36FDB6E629
                                        SHA-256:F9CDF7EB3066FDEEF555DD70443C240242234CA5B36AF240BD222A12EBFC88C8
                                        SHA-512:207D93EE3FCEAA828BABACCA4096B4993BF18A37D78F9B25264D90040CA4E53F08EB0827284EA509F12AF582A4E97B403132D0E092B92D3800C311F0762CCEC4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{....o...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_d19405_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.776460888119716
                                        Encrypted:false
                                        SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                        MD5:33811FD387B89600054B9B4D630CB7BD
                                        SHA1:47AC7CA3C55ECB67A81988BA4B281DE8435E745A
                                        SHA-256:68E40DA32A12AF442486BA0220013FF82A343036CEC671EFC2E0A5D4B82F4BBD
                                        SHA-512:77D0C1E6D9E50D80CB65A0254E34171AB668CD65BEE32BA81A2A706CAD774254B1B6EB3E43197D2DD5D7F776CE7223070F84B37BD22BBCFBD1566B90FD752EB6
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.........................................................................................................................................................................................................=q....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_eb990f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.774483769238085
                                        Encrypted:false
                                        SSDEEP:96:8NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:mHm231Nvu+wIqltWOe3nIP
                                        MD5:5BED011F03268413C39AF392BF473E01
                                        SHA1:4349B6BBAF0D320D4F3BFE3747C6CA2F99F27FC7
                                        SHA-256:C39808377E9431C8964EC2FBFF597979A0F6DC8421D7483FA847FAC7D536E209
                                        SHA-512:19C910351FF5B47444F99D7625A4489B74D090E538B01E790F3A300457FAC8365F9220FE80AFAB6B927DD51D178672D6CF9778B1F6FF9A32A2BE2CC6B9C9CCCD
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_ed9f26_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.770555207484389
                                        Encrypted:false
                                        SSDEEP:96:fNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                        MD5:776F11EB6071FB17D2E75711CE1E89D3
                                        SHA1:8354AD062CE0B5148719977311DBD23297F01579
                                        SHA-256:BB48194B1AF84D1A99F8F723286EA5F752D0DD76519207B677677139E7A77268
                                        SHA-512:281151539060035BB7F09739ED2ED2F959113EA1F8298DBC880924547BFE6C9B0FFB1CBB29D71A1CFBD72BF5D791065D31214BF35545075E0602960D54593607
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_fadc7a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.767152740736307
                                        Encrypted:false
                                        SSDEEP:96:zVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:zlHm231Nvu+wIqltWOe3nIP
                                        MD5:E8D6D9F9DB95005603433CDC65F4186B
                                        SHA1:9BA6A7D43C9A9C1DA0432AB160BE638E87F89402
                                        SHA-256:D50B564FA87639E5677BF17E196A158AED18223B34B51EB866F0C9B06BE3BD8A
                                        SHA-512:BB9B0DF811F8C2508178A83609E0852DF6A851EFA89ECCDF20F24352939E7EC7A886B05A4A1F6AD600F533EE2B8CEA6E4CA88A1A4EC4473A653DFAFA05BE51C4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..}!...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_ffe180_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.758025434515704
                                        Encrypted:false
                                        SSDEEP:96:HNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:fHm231Nvu+wIqltWOe3nIP
                                        MD5:480588FD701F6364B94ACE011BAFA5AD
                                        SHA1:0C51698F7DC2229D60AC2E526419D4B55B839023
                                        SHA-256:A5A52E32D7DE992033BC16D32E0DB66C5B367F1A38EDA828214C1F70AE99A54E
                                        SHA-512:DEC9ABB40B77F6074E1740351F7E8B785A7EDC14A173F3978821682C7D408FC1DA56E454AB557043FB25A2C5BDC7B27B67E92F4DB53839792BC17CD418B1C2CF
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................D@@....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36679
                                        Entropy (8bit):5.283625431419401
                                        Encrypted:false
                                        SSDEEP:192:10OW0C2rcBb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHx2Qd:Dr2b/+vaW1e07dF5fyFEuDS25u
                                        MD5:22BE2A4668EF7388D02F010F5687AF0F
                                        SHA1:755F83AD7BB15369A614494BA0E6278C0313B261
                                        SHA-256:2730A7FAF0B7C96FE8FEA5C4B1A403C2748F73A5DEEBA6C3E76544FDE765DF3E
                                        SHA-512:32635DF30CF7209ECC76C1D6DBC78C4FC4E12325F53B1012B21CA2190A4C56B2BB2FB787889C121C62873741F5BCF4842B0BF1AB43A3C5D654DA090AD51ECF9A
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29652)
                                        Category:dropped
                                        Size (bytes):31456
                                        Entropy (8bit):5.228582229143624
                                        Encrypted:false
                                        SSDEEP:384:Dr2lcR8lOXHc11ev98zWmk+4b6GUwQFSc7nfZBhV/:/BXHcE98zLwb6GUwQjBh5
                                        MD5:8A6695FD927DA4B1578BC0A55B07EDA0
                                        SHA1:82E9666B5E51982A1E2C1A072820DD3D077AA193
                                        SHA-256:26269D72781AEBEC6E130F76513B536C526BD524ADB123D83A7EC7D7F78B4D32
                                        SHA-512:B7FCA5F397A6C706AB6380F317C45475D580FB4D5250CB544533CDBDEFF3BC59F39A8AFC98CD9332EDAD59F7FF49D797384CAB99E9DAB2ED91DBF50478313EA7
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1381)
                                        Category:dropped
                                        Size (bytes):18025
                                        Entropy (8bit):5.092719134695988
                                        Encrypted:false
                                        SSDEEP:192:XQ2rcZ2QyMTLZF5fyUPtNt38EcvJmVzYRgmB0iBfT9RhS2wV53skuMaaSQhQz0iu:XNr+F5fyFEuDS25u
                                        MD5:6AA923C141500B3D7989C46EEF53602E
                                        SHA1:213C4CC09900A1CED6D8A01F05DF34FA0A0459BB
                                        SHA-256:BE3C9D96538238974D013BFF2FA18A89A800081BB71B5FB0D8F7A75739EFA47A
                                        SHA-512:8EB56EF1068E4ACF585CA62DBFBFE33270B6E7875571DADFD5869531C0AC02F7E9C5759C13F13EDC68B6257196991BBCE4268FD040D295052EE98DCA60601C50
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&borderColorHover=a45b13&fcHover=381f00&iconColorHover=bd7b00&bgColorActive=ffffff&bgTextureActive=inset_soft&bgImgOpac

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_10_4f4221_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):365
                                        Entropy (8bit):6.359300406286935
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5Ej1aPRmg88IoROJvd762zgN+E893CEMl93SGp:6v/7UU9+JEoj8IoETzS+E9EMek
                                        MD5:0C4AD56477CD90EB0069DCEBE576132A
                                        SHA1:0AA318036C772188BEA996B19A08CED776CDBA58
                                        SHA-256:D1AD219B06B80A6275ADEFF7FC7C50AD93F5F67AD242E28D2EDCED087D0F0151
                                        SHA-512:5F642659EEABEA648BA3C85CB839EC49003CCB1F6547DE36285305651B9A68C3FB4F187A01B43F14C7FED2CFA87A5BC26ECBEC323B3D1ACFB75E84F340C67EAC
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......qIDAT..c.........:......`.a..~.Y...6.}..<7!$.C.piCV...F..''EE\.0..._...C.,...x.....@......W.C.........!.._a..."...R.S.[I...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_20_372806_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):368
                                        Entropy (8bit):6.341460797434122
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5EQ4w4iJoDa+J/uh+yRORCwh7zgN+E893CEMl93SGp:6v/7UU9+Qv+a+Vo+rcwh7zS+E9EMek
                                        MD5:90D7BAD55C1DB9844BCBF735DAC1F074
                                        SHA1:1AEB567353D7A6937979BA8D388D6190C9D7D2BC
                                        SHA-256:F3E3D4CA130EBC403DB3A0009B9FE2A52AD978D6E745A9ACD0FB7AB9657E76C2
                                        SHA-512:83F8F1664B8133187019ABADECA53A10BDE2E718FC12B6A66903DC970D9B62D95463C69D2067AC98B0882E2D04E781C8A893785195C0D2115EA8B83D2A05B40B
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..ctM6O._..>].x.}4......\.,.K....c.K....L..!+.e.........m....O. l.d..l.".^f ......W.C........_.#...\...l....dS..X.e...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_25_675423_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):370
                                        Entropy (8bit):6.364510427201636
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5E6nKyhIPHsKznqygKgj3vzgN+E893CEMl93SGp:6v/7UU9+6nB+fq7zS+E9EMek
                                        MD5:5AB9A60FB50076625FD74755BCE76859
                                        SHA1:6D322B4FE90AE0214ED49E065F3F774B29B1D3C5
                                        SHA-256:CB378A5778653E235F5A930201DE24E3EDDDCB820BA87EAFC690DEE381C34317
                                        SHA-512:0BFEA8A8A42CE5FD47DE2CC0E31080D940BADE666020792752C9ED339D69F0100486B6E091770ADF4B42B6A6BDA9347360DB78D671A3DBDD27DDFBECF75D2451
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......vIDAT..c,..\e....|..x.m3...-.W..E.a.M..>.+....L..!+.e.czzH..2.m....s..:.6.....o._V.....p..l...."L.}.?D.kSs.......`....][..9b....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_25_d5ac5d_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):371
                                        Entropy (8bit):6.349255898525815
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5Efw2TjvJM8e6Q8iUEb+vICiKzgN+E893CEMl93SGp:6v/7UU9+fwIJTVy5E//zS+E9EMek
                                        MD5:5ECDEA282139116CF454F59CD8F537D1
                                        SHA1:5B6C7458B943F228CA0DDAFB4DC49FCD3ABF9440
                                        SHA-256:9820FE8B19C77127DE4F323E5CE727B46AFE526288CADEF095C447E9D85BC5B5
                                        SHA-512:167C6CAEF5D76AEE93735927EC67FE891CA12870D0C6EFE904CFC8ECF021BB41057E48EAC649C4DE2EE9C8C20640590B3831FF0E11EB5B4A040D3BCBE94195AF
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......wIDAT..c...-{;.....c.e...e.G._.....ml"<L......L..!+.e...k......~.......G.%.-.....~....p.3.....a..+.!.x..u%gq..W.A....L....q...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_8_261803_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):368
                                        Entropy (8bit):6.381127254253966
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5E+pNMNEveuJHIYli8z3NaoG2zgN+E893CEMl93SGp:6v/7UU9+YmNEveupL9ah2zS+E9EMek
                                        MD5:855FF8ECC98B25F215023428712CE7DF
                                        SHA1:172BDB83B4167BF93E525409CB615AC084CDE564
                                        SHA-256:B3E3D422D3DC49E0E158E68C57D1CD26A50D61857ADA726D7CF64453AB162924
                                        SHA-512:3ADA1153E631BDF83CA5FA480615F8822B20D0CBBECC200C8E8063DD6C681622AD7F11524D3D5A053E0DADFAC201816248FD5DB8F69FC880CF5E868C06ABF9F3
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..c..[....~..U..6..`Sg.aWE.a....k..j...P&\...2.QMMB....6L...7....6.....?..T...p....}.?D......0..)..[..W.......P-.....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_8_443113_10x8.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):368
                                        Entropy (8bit):6.3299103458725385
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPcUyKfp5ELxMOLyoPRvmkz1N6ipF7xnlKzgN+E893CEMl93SGp:6v/7UU9+LxnLyoPAI18E7dlKzS+E9EM/
                                        MD5:0A81FF0F2DDB965C675C7FB95A340BEE
                                        SHA1:992441E9D1E2E4C4CC35BE963EE7A9D87AA17BAC
                                        SHA-256:6BFDB6EEC896A086DDB70B06DDFFCA458579235B08C1FDDCDA935EF1079EEC6A
                                        SHA-512:CA6E45BE527F7C317F8458052D54721147B6DED81E8313BBB72E84F7090140D7583F391C72C981D5776CC29C316EFE9A45A96CF80112991638A41529D1C7A27B
                                        Malicious:false
                                        Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..c..h.!y......K.?..`.e...Y...6...].o!$.C.piCV...F..CCaa\.0....e_..Y.%........!............~_...F.7V..p..W.A....O,npW....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_highlight-hard_65_fee4bd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):372
                                        Entropy (8bit):6.384221632259222
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPeogUyKfp5EAUbEn19st28A04nqJ8qlRVgiFcSuf+vzgN+E893CEMl93SGp:6v/7WogU9+ALn3sXADn6lRVgoxQ+vzSp
                                        MD5:298B2329A688FE3BE43FF15754D3ECFA
                                        SHA1:77E39DA0BC3193E4B125ADDB9B6ED6BE0F0DD8E9
                                        SHA-256:C7324EDA15AC8ED7B7705EE989AC028480A654606B00A53CC588DDD53AB76A24
                                        SHA-512:70AEF10577B1E1522CEB34AB5FCE5D3DEDC3F457398F44BF728DE066058EE534FC2730FC0DD23FE219FDEF5AA9176769BF8BEE89C2D81D02F88258D367F62FBB
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......xIDAT(.....A.D.QW.XP.p-@B.G..h...*h....s......MHP.xc.o... ....x..*.].Dv.H^.,FO......&.btSO"..{...L./c%...r......!.B.:.P|v]...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_070603_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.761923804558602
                                        Encrypted:false
                                        SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                        MD5:52076AEB12F3F4125FA6C5200DC2CDED
                                        SHA1:875EC60B0B5B04D87FF4AE44C20C4E555F6BC298
                                        SHA-256:A02BF13EFD09394F94DEB427F08EFCB57D8E22C03F85E6211E1542EC86561BE1
                                        SHA-512:65A0399BB73F911B28862CD052A94A19A072BE1273ACE7E6FC66C7EFEB68E3E35AD8FCB0E3BE74D23B8B4D002EB15237F8BAA46E9D79177F7C9BCF9D46213283
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................s.d...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_e8e2b5_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773782478619946
                                        Encrypted:false
                                        SSDEEP:96:nNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:/Hm231Nvu+wIqltWOe3nIP
                                        MD5:3F7E25352259F2D9287379BB49F4129A
                                        SHA1:ED8411A6BC4DAC4ED86FDC740C4FF513C9963FFC
                                        SHA-256:15A23E52BE0364E297B9E6915278E375F351CACC2C2ED9A5BB186DE125145086
                                        SHA-512:87828FE294E2DFF9C6D754ABC3336CE6E0998DFCF98C67B90BAEE1D5B6ADA88DE1F782942B3402E34A47EE2CAD0E4CC02F23A1968A362982C6CCEFBFACB552F0
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................L.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_e9cd86_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773474449917077
                                        Encrypted:false
                                        SSDEEP:96:nNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:/Hm231Nvu+wIqltWOe3nIP
                                        MD5:D3F0FA26B37CCF94A53EBCC2406D5ED0
                                        SHA1:00B4CEFDE751F65A2A8FEF6FE17E15393E40BDF5
                                        SHA-256:0A4704D6AE092BC49A0072237AD91EA72C42025B3AC37E56D737D00057DBF64A
                                        SHA-512:F8EA60FCCA9C66931B66CF6C174B3DAE0E588BAB560D6371A84CBBA15E01BF6754D293A4EC94F0A53DD7E2CDA26EC0AB1C853EC17C7A79D112332670BCD5A00B
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................$.6....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_efec9f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773201461632952
                                        Encrypted:false
                                        SSDEEP:96:9NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:tHm231Nvu+wIqltWOe3nIP
                                        MD5:766D9DE9AFB37ACB6D3B2D63E58624B4
                                        SHA1:C2690B02EFD7BC1995A0FD7134A2944B824F34FB
                                        SHA-256:749EA0F36E027265CCC24949F9F6B683F862E3B6B285F66C35ACEB258C79D6E7
                                        SHA-512:E899F5E3B2E195F89B167D5145BB1B304CA2E9AA1BF39872356FBC3FC003F747CDF5A36B3925B3AF68C3C90E22E2FA721226E1510CE518AB02A9272338CEB95F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...........................................................................................................................................................................................................[...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_f2ec64_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.771441630990325
                                        Encrypted:false
                                        SSDEEP:96:ctNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:c9Hm231Nvu+wIqltWOe3nIP
                                        MD5:78A0CDD2A1CB63ABA98233AA0FAB4403
                                        SHA1:EBE3BCB06403818A400B345C63BB6702558C1583
                                        SHA-256:83AAB22FA7F0D3E71F02EBBA1E924193B043F4C73B11FDCDE09150A23B5E9C78
                                        SHA-512:EA2E9967D3DF3D5E40A03022F02389EE1B3D6C7CAB3B0CCEF9C34339CC4285C8404E680AAA47E8DC8E235EE47762D03225F2C40DDC3952A47FE41597AA483A55
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_f9f2bd_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.774286621668153
                                        Encrypted:false
                                        SSDEEP:96:ZNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:BHm231Nvu+wIqltWOe3nIP
                                        MD5:DB72B92A0F728CF5CA2E796BB8B16F14
                                        SHA1:01DA752C86E7E385F39D57EEF94727D90CF7DAC3
                                        SHA-256:C2ABCB934D66B1C551E084742E0627D22CF0DDF9AB2DBB350148785D2CB87F6E
                                        SHA-512:1DA590DCD1D670A6796135875E4EFA8577DA0148DC17C23323141E0368217D412A876860108354D9E5B1243759A34922258138F00231B8A615583782187824E4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................'..2...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_ff7519_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.76872546534799
                                        Encrypted:false
                                        SSDEEP:96:MsNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                        MD5:90D4B95F7F5018E66653FF33D32F35A6
                                        SHA1:0AEA94585C167FB945886AE060AF265690E11AA3
                                        SHA-256:5E8091D9C902F959F52E76DB516B55E2AAAC0050073A1815AA3A2DF53EA7E9CD
                                        SHA-512:68A8B2C2430E1AEFEE986C32B2C877A843E2AE9E94DA6A591860917C4316E35DEEE733EC69EB0368910EA5B4FD298234634EAF84EC9947A71AB3495E6FD3363E
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u....z...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36686
                                        Entropy (8bit):5.282561880141542
                                        Encrypted:false
                                        SSDEEP:192:10OW0w0b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHVjkubuh:E0b/+vaW1e07mF5fyWE/DS25Vc6KTq0
                                        MD5:E2BB4786D0AAD000C30B2034700B8C9D
                                        SHA1:3EB8126EB7DF461DC1FAECFE8BDA0E5815C0927D
                                        SHA-256:0F9F5CB35A2E81A3698ECBE195C723476ABF3BA3579AD162D1386E979AE7CA79
                                        SHA-512:7DF5F51BA647BA84F7DEBE1E4F3530F4D9C62F33B259AE514C35E7103276B34725D7D672DE7B8783DD50F19D3393373B3CD60862CB63E18C577F5DBEB76B0440
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorH

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29700)
                                        Category:dropped
                                        Size (bytes):31487
                                        Entropy (8bit):5.227925899943147
                                        Encrypted:false
                                        SSDEEP:384:E0lcR8lOXHc11evEUzamB+416GTosZSc7nfZBhVJB7:8XHcEEUzvx16GTosnBh5
                                        MD5:3E48471F78CD3C590DA3C207BCB629A7
                                        SHA1:F300E9EB2D267B0CD7BD3254D6007B385CC4B498
                                        SHA-256:921F677E244AD4D54DF0D63312F00E1D0708AC9B44BF66EEE22AFF4A5CC7290B
                                        SHA-512:7F3FD7267CF98193C2A74C222E6BC1F431B968A937EADDC0FB8F9BFF5EE6F2EF0E3F348F94926B05EFC00745C62FD46776164D5DBDB2C815FBED4BEFE929252A
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorH

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1364)
                                        Category:dropped
                                        Size (bytes):18032
                                        Entropy (8bit):5.089695775507098
                                        Encrypted:false
                                        SSDEEP:192:Xa4jkubuF5fyQLBRpBEcEYftrc5gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6Kd:XaZF5fyWE/DS25Vc6KTq0
                                        MD5:282A7F8B37DBA43F8EDF8AF548CCB842
                                        SHA1:7C4348644E724E38D85B33BA6292E5502CE3194D
                                        SHA-256:74EFD4238A4123388DE6669D838E56DEC1872082B1381D1F42272AADDF35CB72
                                        SHA-512:6B143E179F98D1C6863AF85593B929F67E0490266EAE4BA4D799257BA8E268919DF21C66AE224866143DDA164771E3576FDA33A64D6780D32E10846C7A68346F
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorHover=362917&fcHover=f8eec9&iconColorHover=f2ec64&bgColorActive=443113&bgTextureActive=diamond&bgImgOpacityActive=8&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_diagonals-small_50_262626_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):321
                                        Entropy (8bit):5.969095203566699
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOkp4/siKZDQ/45urzgN+E8VLEMlVbEbp:6v/7MCU9Z24wrzS+EELEMPS
                                        MD5:BEEC31422028ADA44E2FC9F0C67399B9
                                        SHA1:CFB2B656953BC92D85A4B24D1789AEA5466313D0
                                        SHA-256:768B45202B00BFABBF77CD80EDE985B94ADC9B4D235B7944F7562556DFF5481D
                                        SHA-512:27A02C3845C1B84631DDD0C067117AF1B9C116CE7029AFDFC7747428EF2F3C4796A87F0626701E7D1722F7D5460D6B222C53579B5EC526CADFD1EFF583879F29
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......IIDATH...1.. ...<xy....".0.-f(1..t7..LI...g.7W.ysR...I...1..C.1..C.1.......'.KZ.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_40_0a0a0a_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):322
                                        Entropy (8bit):6.013416891415952
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/76XEjnd8bsW2zgN+E8VLEMlVbEbp:6v/7JSUm60dcGzS+EELEMPS
                                        MD5:82027CE0F484A87E95BCB001765BF9D9
                                        SHA1:5481163B02AA1A4126B133D2A04714F373F653C0
                                        SHA-256:C447462D023313A40ED37F3B19AE0C252F16BCB9D9B0843B8915113A10E56A5E
                                        SHA-512:66C4A129AA5F8692620F29D21E244B5EF288A27F68B061DB755488910CC86C63D2374883E629D1B2E4A88780161B9D08331FCF31D1716729ADB58D056386A373
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......JIDAT8.c0Lab`.E........{*.?.....q.&V.&V.&.t...Ll,L.,L,..X.X*....\.....hH ...._-_]....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_55_f1fbe5_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):6.5436702640430315
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+Toatzvld9u+UwWtDt66PWnOj2zS+EELEMPS:krr9+rvlcjxGnTzjEELEMPS
                                        MD5:3C091997535752F9243F6DED0C2E6698
                                        SHA1:850675BBB5B78120333643D19AA3E34176E5063C
                                        SHA-256:EA7A70F9E57E75AC0387E23CED494C0B76F5BDC0887AEE232ADB87BCE3EBD731
                                        SHA-512:0AFC12F899C5EF305581A03003414FDB097271F173D327FE8CA3444C77B29809ACCE3EB5D7265064DFFAAEA815128419D685D2101B3D90789F4D8AAC0F8C4186
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..`.........X..`...5.........ch3i..b..........g.._z.^........0...eU.$.mW..JD..2.'K.n'..@.JL ;.....9!..q.t.i[....=e...k..=.eH..RGi..a...y....9.u....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_60_000000_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):323
                                        Entropy (8bit):6.029041180694467
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkp4/dlUD5kMFUuSSU38EE+gzgN+E8VLEMlVbEbp:6v/7JSU4izFUuFU38t+gzS+EELEMPS
                                        MD5:23B3F7DE6E50862D3FCCB373BB9C7B50
                                        SHA1:0D022B4CC99ED181474BBC7F21CA8186C402B3E8
                                        SHA-256:5A0C0AE716650BEAC2DBB4C97F016D3500597F422E84721B0709CBD946516244
                                        SHA-512:76730FAE5F0A4AEEDBC9D2385886EECF350D4F1A883DE59505FEBD6ADD31BC6791EF8508E2DAA3DAE9A19A6C6D1AC8B781D1B5A3E38890B64E628F0BE55AFB95
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c.-`b`.E........)...*......&.+L.W.8..L...0q\eb.bb_.....e.....w.(.......H.!.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_55_000000_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):4360
                                        Entropy (8bit):7.896724830756886
                                        Encrypted:false
                                        SSDEEP:96:ft9jMnMxf4/vawA0p587C1KpYOgc1JMvh+r1PNH9:zmoh0pcCLOrJMvhG1Vd
                                        MD5:17C87F985475E4C876DEA26A1D0F2E2B
                                        SHA1:4D8D1A254AD38F5D9445C0B5F74A8E384281C330
                                        SHA-256:9F64350254C1884777FBF7C76DB07A027FBC4DB6B02EEC09462A23023F93574F
                                        SHA-512:532C8659F11720326B5C365F409391E799B6CF76AB4530E5F8C465E3BEFDC17EE5058C9B0C27C3A97617A4F1ABC4B607A4B5095076FF49985889F77D1C09FF66
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..]O.%G..j...5..5!.b....A!.D..BB<D...'oz.W..9'.........s....s..w..(.!...&3....?...73/og.....?.......*..;.p8.9.v-....>.Bw8..~.;.{.....=._...../t.c...............p...Bw8..~.;.{.....=._...../t.c...............p......[.M.%...Si.8..^..R.--.M7."I.|.7/.v.:i=....b...j[..Z@.j.q[Y..|.l*.xh~......e).@..YD..SE...:Fl......R..{I.l9........%...Gj....s5..m.j4.....V..hF`.h.Q.V.u.h^.R..^.f...R.gZ".."......E4.........w,.....Vy.g...DB...../.W.#..q.....pl..uw8..~.;.{.......T|....>...(.....B..?.G......eQ.w.$..mS....rK....?D.YeNB...;..v.cj/...-...g.d_q.&...\[....}$..F..K-..%D.!.(c:.NG...RLZ.m.!;r..........5.~8...)R7....:._z.7...nG.....$..i8#..... .M..L.D....(.(...O.Fi.5.L..>N:R.......d..<k..6.i.#.c..^4qIt..D1Ya..|......].,.P?j.:i>q..F..$.y.7..N..IG..S7.....i.m$....QC%o.3+....f..O.L>.....R..a.OQ....%..[\....|.)..|%.J..,..........R...-./.....%Gx

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_85_9fda58_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5998
                                        Entropy (8bit):7.68334741302507
                                        Encrypted:false
                                        SSDEEP:96:fH8ylGlwp2hEBlNwyr6H91M4/V4PgTE8GLySYhS26UD8B9YTaM71JhKLCMJLsDT5:P8yM+aEBwyr6fO8SO6UD8rY1JhKLNQDV
                                        MD5:90B65BE924BC8BAE9D724E2CC02DC0E9
                                        SHA1:39A5955C542327F2F8E3CED937B2CAFCBB11E8D4
                                        SHA-256:DE6AC849F1A18F2562015281888F0351C283765346EEE45065544B64994BFBA5
                                        SHA-512:B6588480410DAB2333E903442FE79230B73295A08D2773C4180738857E9A53A7D8A0CAAC6402B706C33457EA4C1F6073972EB492C45272C4BF365DB7ADC6E525
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......rIDATx.._.e.]..>......a..bc...I...$>...)L..V.L..UQcc....K ..P.v.b...!i.a.J.} i|.a.it .cT...}8wt_..|.k.}.>...a8..Z...}....b.>.6...[.~.........................`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V........+..w........;......p...4l...i..S}..K,..)....>)...yj....W..BI...-.\....;..5=..x..*.)1..T*-o5......SW....U,xc.c.+..k..d-......(..[{}_-.'.+P.g^.{.5y...l...X..J,%....<c..W.z..f...........4..?.@]OR..Y....7.%.:../&...X.2JO;G..E...V.WC.\...ZuXbm........K.~..y{x]....T...o.._..d.....g*.nU.:...ws..<O......_|.O~..L........vk..........*.......pp.....X.&a....a=....\....{vGu{v...vlR..-..<.RZ...g.u.Tr.......6.G.....z+......v..b_Y#.(}.<US.y..tS."eM..S*.........x.7..z..u..........?.&.^.N\].SPj...7:o..\If.bL).."......a=.m6...N..l....s..K...>.m3e.k!.".yj^[.{..%.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_95_f6ecd5_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5856
                                        Entropy (8bit):7.695827834591236
                                        Encrypted:false
                                        SSDEEP:96:fHaTHTdjK4IL2FpmiiMs3bDu8/UvKraICsvbjIPV7QAhB76Xgv8yrsKTBIb51OVG:PaTHTdjKpWmiDEbC88fEvPgxQcujO5uJ
                                        MD5:6AA84B2BAE200FBEAFD07E24AD43455A
                                        SHA1:B185CADC465B2F04276AF2A7E473423D20AA191C
                                        SHA-256:F42C18E0BF7B3002629A4F59437E189A9E64CD51B55277FB0DA138992899D016
                                        SHA-512:32742795C1E8FD697F9F453FD6A99AA80E96B8074E1505C44167F6E927B4B72C790771EB84DC0832B25D0374ED66D2EC397EF3C62968815EAAD2A415C1D3F756
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O._.u..........".l.J..%1..]......P.P..n.0X.5.jw...-..q..&..iT.h\...4.....&v..E..7..^.oL......{....?.E2...s...s.{.y....s............9.n.......p.p.......\...............f........3..w........;.............`.p......0..p.......\...............f........3..w........;.............`.p......0...p.].:.EoO......oOYHE=..P._.F..e.yu.[.d....(}]...Z.3.W......M...VS..U.:.|}.b....k_.%..W..Z.w.%/.=DQ....>.9'....YV..sM.}=..}..X\U%.....#......|...C........Ufi.....S..')k.Y...7.ext.y_M.....z.Qz.s..\..j..z.Ze....).S.fY..f.....e{x]....T......_.%.B..o_.3Uv....oD....B.'^...._.8..*...........o...... .o........\..........n.eGm.9q.H.>.........3..'5...\.UJ.....u.u%.....(.+>....[S.D..K.."..[AcgY.....(}.2US.y..tS."eM...j.WWY...{W.p.7..z..u.........8?.&.^....WA...,/..=#.r...RR..`Ts.n......;f'...c..-..C......-.3.m.,{-..Hy..7.C~.<....k....B.J

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_000000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):5582
                                        Entropy (8bit):7.907240701635631
                                        Encrypted:false
                                        SSDEEP:96:Yb/yH8NygIX6nLdhN93db9hmzC96Xn5J4S4UwYXE2wnlFMeB8M3lVwaK:O9DhNVB9p963j4U3E2OL18M3lKP
                                        MD5:7966D89AF8120E125F0FF69C09B0B848
                                        SHA1:D6BC3DB4E6BC8FE9AC99016D77D5DD613EDA8712
                                        SHA-256:9BBE3706E904C6BB15B897255F62E87955F0A35368EFC3CAD66383B07C27489D
                                        SHA-512:59B02BFC125F2902C72FF3712895B6E2CA260A27A3D430C9BA418601330B7C2B475243BAE072BB2685ED58716773D1B5160668FA21EED23C09C8810543215735
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....#2....tIME.....%...'E....IDATx..].d.U..v,.`.D.8..d%?D.!K..../.......C{...h.($.20.....&q/..q.f#..e...d....GVb,mf6!.[Dq2^.ay..Ab......=U......f..T..;.n.Su.a..a....`.0....3....+o......._....].".&^=..E.A0.S.w.../A<......:.............h...@..qO.W.FZ#...b.1..=U.V.=......................~...N...P...........U.v.:.W..9...0..0..0..0......'p...+Z..x.O.n W{.!....@_...}..IZ....k....c.?H.]..."..t2H..j..)U.m=@.t1-..q...w..R:...Nv..9....H..'.....3hY... ..r`...`..cW..a..a..a..a.".yg`.ps.....}.:........n..1.H..pS#.v.^AS.....g.{@/.%v|....c.. %T....Rn............R:..t...0.~.)...7W>..wYIO-~.<...6..^......{..n..0E.................v...#8v..?..._;.RS..N...b...N.1D..F..cL...9U....m.O.y.`/..}.a..a..a..a...E..u.N...h.jI..v.w.S.gY..+@..x.......!..&-. Z..LK..t..-.}..&l..h.......(.QJ...>...([..W...F..@{..pO[.fD. ...~cy...kvj.I..I.~..&....x.......I]7...Rj/._;.M..&..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_1f1f1f_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.92694681304517
                                        Encrypted:false
                                        SSDEEP:192:tVhcH5ZfLGSW2vWMqWNB76LeulcQVmpibEJi28h2O:XqHjLVWQWZWD76SuCQEpDJz8t
                                        MD5:A70FA5A611F0DEF8348F06C351A76F23
                                        SHA1:CF6BA7CC0A4D02E6D384ACFE69A6AECE3B9688A8
                                        SHA-256:3C569FC82FDA71677ED5A74C63F07428AB8EE88E21362D85272A6C17BE55F213
                                        SHA-512:E06C39886D6963DB6DF852F3D8BC4747A5A0054CEE2AC39FE3281F6F29EC0DC3D0D01A6B56DC2AE9D614C67E31D3E8B1A83126CCEBDF6710CEBF0906FD1D225B
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..'.......tIME.....%...'E...TIDATx..m...y........R `l..@Z.j/..K....m%.I...Jh.^.4!.R.....K`.6%..jmA.!.Km.. ...U.X..v.$.i..:4v.i........9.3s..;...s..y.s..y..`+.M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_9fda58_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.769365641768271
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:49730AAD2088771F212C33FB18D3D65E
                                        SHA1:1BBB14E259D74C023FF328AB5AA75D8A87C9FBEF
                                        SHA-256:873FF4B32563F5D6D8650DA05E037F5F8422C6CDB579886D430548543B7C2361
                                        SHA-512:9DD054954326D56CCBB0F578CC99ADBD3A466DB9339F717CC26339286C2A712186D449329D5FBBC65AA24006C016C1AB716552999615D488D3060C7BC928249C
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..XG.1....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_b8ec79_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773633402963814
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:4CB0A6D0B5C53EC1C5031AC876425E57
                                        SHA1:4A582B04720D4DD53685E8E0CEEE080308D90211
                                        SHA-256:210F3C33CA07E364B75644F215430214C786E88D177159723EF8D962007E2706
                                        SHA-512:087B5FD5B50DAA776C26738FFA6A6CBAC88CCAE00F871CF72A00DFAB89B38F591A7A5428CF9749DB33FDD85753CEEDD9A8C5298D1BC9031FD540E1127F86C70D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..:'...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36666
                                        Entropy (8bit):5.284323041058013
                                        Encrypted:false
                                        SSDEEP:192:10OW0Cp4b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHh0Po/8:Y4b/+vaW1e07eSF5fyxHEnDS25gTv
                                        MD5:5DEEAF290D0DB83B7E3FE6FA2B76277E
                                        SHA1:D547DD72F0280E4E9C551713EE4D61438A395635
                                        SHA-256:41C6B4B69C19B71E04E9E6C1FAE9FBDAC2E97D1FBE4BFE34D110E121B5ECC237
                                        SHA-512:C4FBE50515A3052E763A49353D18E23CE1DCC773C997B571739B46DA05BF7A7591A0CC6B33B04BD6B5E29D21E0ED80235C86AAB976D5AF8EA9A67739A8A12190
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29640)
                                        Category:dropped
                                        Size (bytes):31434
                                        Entropy (8bit):5.228656652836556
                                        Encrypted:false
                                        SSDEEP:384:Y4lcR8lOXHc11ev0mNz/mu+4U6GbzenSc7nfZBhVMC:8XHcE0mNz+2U6GbzepBhB
                                        MD5:35C76DACE5BB3A2E7F6B43B1BF3CD721
                                        SHA1:37E3D9A815A86F6876222EF509067E6020FFCB1C
                                        SHA-256:87E36CD9B3E0EA1769E0112DF0915859FF9CCA362A648F022A61C00930FF6C85
                                        SHA-512:A4C19C0E28F5E366C6F5E95BBBFB79AB513881F00F868CD92AF73C9723F77821D2C9D52F03744D451B1B3DFD54489E00D699DF250DBD83135A27B1A681189585
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&bor

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1371)
                                        Category:dropped
                                        Size (bytes):18012
                                        Entropy (8bit):5.093213207857892
                                        Encrypted:false
                                        SSDEEP:192:XQpY0Po/ActF5fyxxFzEcvYPPANNPmgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhk4:XudSF5fyxHEnDS25gTv
                                        MD5:B9372C0BA160BF67375785C6AA74BEE8
                                        SHA1:DC904367D60386F046664FD0ABBD46860F36E406
                                        SHA-256:0F740482C84A149635F253557D58CBBFAE95F19161722725BCC54D72DB0E3E3F
                                        SHA-512:602214B0CE53517AF6AE45E746A7C1D77707531E6EC10CDE51B9D8A85E21852F692E4258F8D81A86F750D6F30DDCF7F67EE3B7E36FDC2485CEC2D4D119CA3660
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&borderColorHover=000000&fcHover=96f226&iconColorHover=b8ec79&bgColorActive=4c4c4c&bgTextureActive=flat&bgImgOpacityActive

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_20_555555_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):318
                                        Entropy (8bit):6.008561760794062
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkSrnLTR6MoHkyvzgN+Em6hp/KEMlOZp:6v/7JSUkrnLTR6BhvzS+Em63KEMlOX
                                        MD5:11F8721561696E039555A6D2BE1A53A3
                                        SHA1:2F5CFF5D9045BCDB1C28F398B5109A51DD30F0E3
                                        SHA-256:D3368B948E231CCA6EC8DCD9510FFCFB47EB046E9FB004C624523131EE5DE19A
                                        SHA-512:C13D384DE63CFC653F0F98792DAA6C9D2E0C8A9D375912CFF5660F034A1BE32A60A0A2C8C5203AA9F2866024D65FA71B54D3C7E3D699586D5CF3144D5C1E298C
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...FIDAT8.cH....0.F....H..{LL&L........11.ebz..t......X..h..x..Ai..<.....2l....<....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_40_0078a3_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):400
                                        Entropy (8bit):6.518893987171985
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+NoYrIYYbfeZ5gzS+Em63KEMlOX:krr9+NoMzOzjEmdEMlOX
                                        MD5:6DF465DE070D719123DA33EABFD7F871
                                        SHA1:79C190E2E58B352CD16E41F42C5579D900C44014
                                        SHA-256:F4421025C0749891BF5259ACB8EEF0FFEDEB16364544921A363318A703F38291
                                        SHA-512:FEA771E97882FB6E09F6FC4475F404CCBDF5AFC6ABB41182C45A9DA55168845964C13AB80762582C997CC6D301014AE08AB6B7D4B95EA82F1CF52AFA06011075
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...1..Q...{.....Pa......;.0.uP)&..=.Uf.*Q(..N..J....V_.''92xn..."""..8..v..#E.z...@..B..kB...ZIE2.3....6Ia.-bJIE...m.D..c.1[.X..B......8....!.(gc...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_40_ffc73d_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):374
                                        Entropy (8bit):6.401625747553546
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh1r+UyKfp5EuP6rs3grEM5E7e+Vn0g2zgN+Em6hp/KEMlOZp:6v/7J1r+U9+JrTFKe+J0g2zS+Em63KEZ
                                        MD5:FC8DF1573F4A44A8C6C1A6C10D3F2CBF
                                        SHA1:F520333BA8EF9554A754CF2E064C9FEC8E71C925
                                        SHA-256:5BD93AE714C82077AAB1B1171816B39514003788BEA55BAE3CB2CF27CF2925FA
                                        SHA-512:AB275E4F6BC5F5BB188FB174388927B2C9E4578943859ABA48F73A6FE74CB29D1F3BF4B05B4562236EB85A6349F3C9D8A611507252DCA6E64DFAA43597C17F0D
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...zIDATH.....@...}.......f....&..Zh..&..:i.N......O.Z..~kZ.@..A..^.....3..AcZ.TRc.&.....T.A...k..U:...'.z_...0....6..`f>.....A.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_gloss-wave_25_333333_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):3976
                                        Entropy (8bit):7.8903193220578425
                                        Encrypted:false
                                        SSDEEP:96:ftf/8ADvO3/zZmSxLHgjyFaJxuf9ZaLDnAb:1sceHZnFaHufjaL7Ab
                                        MD5:06CF28ABF236C7E905E03E79C54C6196
                                        SHA1:00A5237473FAFA2FA1B5C9BAE9D3F5229928B4D2
                                        SHA-256:711D5BFD6EFBE4159B9316AE37B97C6597CC20BC41AA17B5D8FE1F41515BBB27
                                        SHA-512:57CDC25EFBDA108C1E5FC79D73F3CDE34030CB1BB7494BAFDB5FC07A5DFCE1600B9332153A94C73E150FE1D3FB518ED72945A1E89F4FF87F26CD9518C02F733F
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!....IDATx..]K.....,../.u..K3..a........o......{..)Dj.xa...|....,..EfVukZ.|..jV~..J.#..... .G..C.@...Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.=.'.i.O...k'S;)......#..2r.t.q..z....q.&..Zar|4..%.G..H-...Y~.c.V..5_#.Z;L...l0..f.F.e^m....."~Qk?Fb....~.d.b/M..lZ./.!.A<r...(.Y..f...6.:..E.K..k.4G`.1..V......J..z..s.....tL.d6B./...k....CA..I.].h..c...(.:.w#.+....A...7...A\1.u'..... 6...d..5.?.$.L"2....._.7...b.9Q......,..+Y[.K..V.)..:..H.TZ.JKB.v.U"....B{H=......#1.......>..G.Gy...x.#...6.....a...i0.. G.4..[..7dG-.$"R....E.q..ocue..?."e../.K.R.K....K....n.BI..-.U..Cs.44.U.U.(....Z...&.2.....k.V~/.....=.e...=<4U?V4.=..5...4.....\..m..v.........n.r.....#A.6......1...I...!..Qw.....#..... 6..3S^...B... 6....b....?.H..}...x......Z..JG../X"...R;z.y0.L;.....t..M..$(.#..T.>t...V=6.}.]>..J......u...=..I5...y

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_highlight-soft_80_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):335
                                        Entropy (8bit):6.113278669095229
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkQravt0CSSZq1ekAYUlr2zgN+Em6hp/KEMlOZp:6v/7WdU5fSSs3A1gzS+Em63KEMlOX
                                        MD5:EEC6910145DAFFE21C779AAA9C255047
                                        SHA1:488063F1C1337971EE1166C864A34427BE063D91
                                        SHA-256:F45D9C0987A11738442831BF78EA54D622FD8DE3000B0C5D9D3D1E79087FBD92
                                        SHA-512:0F3085AA60EB013004674E91A3574807F630B47AC1B1852F4DC1A2FCF29CC39748004A69D07003C8B4AA565789B0723367581ADE792040AC2544EC50C637B570
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...WIDAT...1.. ........v0.......8.......W.8s..<.NPE......!.<..IEL......M.\.0..N.%4x_k...-1..W......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_inset-soft_25_000000_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):312
                                        Entropy (8bit):6.034147603751223
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkgkblqwtB5W7Kf2zgN+Em6hp/KEMlOZp:6v/7WdUnBq+E7K+zS+Em63KEMlOX
                                        MD5:5F96013D83CA38E61881FBBF84F1BD01
                                        SHA1:F7F8FFF3D39F148DA1A4F2B95CCD19FB6E05B0FA
                                        SHA-256:67A5436E917759B5CA0965A74C3D603AAFFB3E36916A907F46DD6F3A3354219D
                                        SHA-512:3205093B7FA0C4E3926B314B0627B209FE338E7F07E15D9BE574A52F6B6C13FF0DAD7F8E407D557FAF0A086F5D29C2D2E6B807FA61897D92693E399364794A76
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...@IDAT....1..0.....@F(...eH{.....P......n4M......I)l..Fc.zH.>......~.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_inset-soft_30_f58400_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):398
                                        Entropy (8bit):6.600503268336194
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+2XOILd7nEJIzS+Em63KEMlOX:no19+2XnR7EJIzjEmdEMlOX
                                        MD5:F97ADA5E876AD704AB2B72740A4FE25A
                                        SHA1:E3B4B8D5F26EECB796E312B0F7CBF4E9F013BD45
                                        SHA-256:BF98648A0DB139C7646766F107FD470CA0E18FAF90AED120B6428F07F8D83AFD
                                        SHA-512:6C3776E29DAAEBCFC07E41F7CCEAB7C811F3BE45AF0DABA328BE3B887A606E05BBD289E81CDCB2952224086BA7E7B86E03D60E6FF8DCC47B536B30AC01F0B616
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(....P.D...B.".HB.Z$.c.k.;W08..Xd..!.......V...q.....|...?>c...x..[....%.h..s*...2.P.8....+*\.8y95..n....p....g.;J....u.h5...w.~.x.......6...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_4b8e0b_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7718687501842405
                                        Encrypted:false
                                        SSDEEP:96:mNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:YHm231Nvu+wIqltWOe3nIP
                                        MD5:853C2373C51B7B7C545D092D4A98B3CB
                                        SHA1:12270D908EAF7EC8C1D3491C4BFB00414911ED38
                                        SHA-256:FA33C9FAA259211591EA1C144246F1CB01B3CB18FD739FFAAE0A4965B979FF97
                                        SHA-512:89CCA39CACFF95B8DE1D1C29B8587EBABB91FCA2F91EAE1F491F3410C7549981E80FBCD188AF7DB63DF94ED7D2BCD301082C50E01B171308F76931EB2CD574A1
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEK..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....]l...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_a83300_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.745691045674909
                                        Encrypted:false
                                        SSDEEP:96:PNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:nHm231Nvu+wIqltWOe3nIP
                                        MD5:372DD47E50840F48E9098AA30D978A5D
                                        SHA1:49F2C2A59C0A53F5400BC19F2F66E516699CDF74
                                        SHA-256:5D119EC862AEC3BE0B0722B651C5FEE065AB8255B0DDAD3D01E1A6B929B7DFA8
                                        SHA-512:9E24AAE1EE5750587C76145C557117E51A04E4B8EB0A56A4C2A88F11808118E2B33575B25AB2AD062A1B5862DFDFA7EDA2B11F5D15C1CA3DF9927D7DB81498F8
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....g...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_cccccc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7034
                                        Entropy (8bit):7.932139241999848
                                        Encrypted:false
                                        SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                        MD5:883030509884C748B039641F5955E85C
                                        SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                        SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                        SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36634
                                        Entropy (8bit):5.280309221019183
                                        Encrypted:false
                                        SSDEEP:192:10OW0CQ8yBb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHoPSp:p84b/+vaW1e075F5fyFE+DS25u
                                        MD5:6A4AECFE4B9DD31564F28C2EE7B26DEC
                                        SHA1:DE0646DA25A11C6D4A853AE9B82C08EC3F2689EE
                                        SHA-256:46F68E72374A75AEA582DA3483B9E7E92730C1D1CA664FB44A4A8120C0766D39
                                        SHA-512:8471611D9A020AC06A0B827F3B9B2A8018F03741F6E4814B37C982BFCE34EE8750BF66ABB908390B7E31A4AC1B6316789BDD6A04116A0036156CDCC3459EA17A
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29572)
                                        Category:dropped
                                        Size (bytes):31354
                                        Entropy (8bit):5.223226346217589
                                        Encrypted:false
                                        SSDEEP:384:p84lcR8lOXHc11evqWhzkmV+446GpbZ3Sc7nfZBhVz:2XHcEqWhz1d46GpbZZBht
                                        MD5:237B0C1A24AA2B71B678651FC1933EA4
                                        SHA1:6F9BDD141DCD877D3F0FB66EB9EDBC9F04CA2BC7
                                        SHA-256:40E96918B8202A37FFC43EA78515473948913B9C6F224F0911D19A6B8C893C9E
                                        SHA-512:C2E28348BA0534B44DBE384925AA39DC6D0051B333667EBCFF5313E8A8880C84AA2C112EE3FE70A63256F44989D5F1204D577F2CFF0287CAA4B58DD154CCD187
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHove

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1359)
                                        Category:dropped
                                        Size (bytes):17980
                                        Entropy (8bit):5.084298001320604
                                        Encrypted:false
                                        SSDEEP:192:XQQ8yAPStd5hYgF5fyQPzH70EcS1poqZGgmB0iBfT9RhS2wV53skuMaaSQhQz0iu:X38cF5fyFE+DS25u
                                        MD5:D9952DDC64DD30C26F4F30685D7E07F5
                                        SHA1:F4DCBB31D47FA4E7C5A74BE86AF5CBC6C3905073
                                        SHA-256:A4B7629CBF15E6A2551F5BB0CFE25C501822BB59EA507B6FC2F8A3CB3F722CE6
                                        SHA-512:C30533286DA4ADAF46678A0CBC9534A223CA519993A19287A4D21991CCC0A981D8FF5039A391DBB358D68326E086015B4D3E07CB543EF56B1B8035666ED590EE
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHover=59b4d4&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=f58400&bgTextureActive=inset_soft&bgImgOpacityActive=30&bo

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):476
                                        Entropy (8bit):6.801036804973001
                                        Encrypted:false
                                        SSDEEP:12:6v/7egU9+8DW7LM/9+RR7/r2zS+Em63KEMlOX:X9+DLM/20zjEmdEMlOX
                                        MD5:AEB4E9CB65DC390A7596D0F9A7372DB2
                                        SHA1:8EEBB6CE0A519300484787691BC4471550386FF0
                                        SHA-256:E8B26C78D61686274193C20EBE7D328E58A307E1231BB01C60001FD6D54F506B
                                        SHA-512:D44C4A994FD3BA1ACB33F01055CE171B7790508B0039A87CC070B1D12E5EF16D421F143EF1F650D1FEC167E092C46EA3AA84E297C165F3D2372BE7F52399E46B
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATh...1..1.F..6^@.-....y....'.k.Z....@.d..y..d...L..O..~2z_...}r.9oo.7[.......R.`65..@Ui]...-"U...q....G....fP..$j...`*..fS3p.T....HT...K......:..q.npt...6.I...G5.Tj..f...j...S..$j...`*..fS3p.T5vZ\..i.npt........h.p.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):384
                                        Entropy (8bit):6.488096122297592
                                        Encrypted:false
                                        SSDEEP:6:6v/lhP0CUyKOk4k55zD4o/qJjnauLAvxxMPNvzgN+Em6hp/KEMlOZp:6v/7MCUf55zD44gTayApxMVzS+Em63Kk
                                        MD5:490AC31FA93F68F9292323E037937BEC
                                        SHA1:C2721F24EB7F4DFF9254F173DA245F826E2EBD62
                                        SHA-256:D62EBBAA1B9AFE2ED31D82593110EF740389CDCF12D740AC31E4018AEB43F86F
                                        SHA-512:2E780F8A4FF5CEAA7AC8826E9D4FDFAF77B2A8253A93826610021EC6B059CD86D7E523F35D2F55CAD718ADABC0D3252F1DCCCF2EAFC8EFE4DAB4BC51E20E7AA8
                                        Malicious:false
                                        Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!....IDATH......0...g...8.W7.dn.../..RD...w......8US...].....5..*.q....n..u..p%.......Hp..p....r.d,'..M>..K...dC.0..@...E......os.)?..K..........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):324
                                        Entropy (8bit):6.0982059449840005
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh8TUyKOkMklPzwIZw//aLZ2zgN+Em6hp/KEMlOZp:6v/7JSUTlPEIKHDzS+Em63KEMlOX
                                        MD5:AE9CF02A88E37C02A866DAB3E4290554
                                        SHA1:994C07B326B659E422BA1E7FA898448FA31B495E
                                        SHA-256:7824BC7887AA24A3CE2669DCB8B1826852DC7092BAC93ED150EC3772DBD7DA15
                                        SHA-512:4D23AA236034FDED161E2713CC921E56155877AFAB93B1C711A1E3EDD3263845B0C7BF4C0B1FAF70F3679C5A4B37C22E2A5D50CBDFD7D17E2B1E1F1221FE216F
                                        Malicious:false
                                        Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...LIDAT8.c.5...a..".".o...K11.1|?..C......b.?.2..ab(c......."..%&.s&...w.(.....r...J.W...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):406
                                        Entropy (8bit):6.56964676945079
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+yKIfwBpTzj4J6qlVz7zS+Em63KEMlOX:krr9+1IfwBtz66qlVz7zjEmdEMlOX
                                        MD5:9A6AAE6A95E61B968FF869599BF14C1E
                                        SHA1:9551A9128C38366AB8029B3C263B4941483C265D
                                        SHA-256:8E15C1E7A06A156139CF1C42576CD2625AE9D5870CD4088B4CACEFE22CBC724D
                                        SHA-512:09E221A7689CD91D7B6CCD4C2FCD1EFE8FB0E7A45A792C62B3CB846B7A7B10E42EABE8780752F7EA918D574EB473826001CB59B253DBA8525C060CB5077FB68E
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...?.........H&]..(..v_.W`5_Ym....F........t.?....;=...eY<#...a..AY&I.R...h`.5.`........u8FD[..9t.F'.pe......z..=...W....].{EpK.:......_...0~....2UE\.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):265
                                        Entropy (8bit):5.620668247500632
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPh3EUyKO0kIojl2XIzgN+Em6hp/KEMlOZp:6v/7J0U0SXIzS+Em63KEMlOX
                                        MD5:ED31481B45167E6F49FDCB1499911BF3
                                        SHA1:4C129F32CABDF52B0EAE217A30360C3571390986
                                        SHA-256:15470C38D6F3194815FFCB9CB182EE4AED0C4E0839B7B5AB0A5FC1C6ECB67C63
                                        SHA-512:7C0199CF2FFB71B0CD5348E7171AC0E2263EBBB92EC8F4C8C659EDA552FAF1B0A34B3263DE0F044360F50E86DDB3CEA23F5CE1C63AC2C514789C58399397A0F2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):5873
                                        Entropy (8bit):7.6864989393853715
                                        Encrypted:false
                                        SSDEEP:96:fHCKpHEgefVb6uUwreFh/nDA+nwSmhOuP+0G9rEDq6b+6LyRAOiZcuWqPkD7MmMh:PCK5Egetb6uxG79whOumoD9q6LoAjZ7B
                                        MD5:437D053C3D8E0491DB75537CFAC2A614
                                        SHA1:CE6EADABE70270A7D8655BA847851C42B722EDBC
                                        SHA-256:A189DE8FE3307A4E2613B1FB3B57C68B2083EB8A9F76984E7A290363799920FD
                                        SHA-512:AD777191DBADFD2B8F1A569E7B4400FAB8566BC3FB9F2297C713E631130B9BBF965B8DB15F97FB85D70C045BCCB90623F1DA406C8148B74A8FB361796FC7FF8E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx.._.g.U......LT..T,..`.....JI.<T.....<..V..Z|.D.e..`..$....g..p...&..%...|.36.'.P...0.{|83...w...............k}......ow..w..........6..u;......7..;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6........f..e..worE..jc.^b.....:n..P...F..y.yu.-.d....^.....Z.3.W......M...fS9y..k9u.[.z_.7..s_..\+..%sA_m..x..Ea/..k}..X.@..y..}....#..{.c.*...?.6...?~...}?3T.....X..We..~...M..')k.(.U..r%...y_M.m..^e..v.V..r..f.WC.X...ZuXbm...e3/.y.........:.Q.....S7......G.uU.T..dvx#...^.y.x-G.......UA&.....h.<,....t.....H..2........;.........a..5..vw....q=...Gz.[....vn....W...Ji....].YWR..^T}....R.....:Q|.RRo%....YV.+s....j.=..U..nJU..)k.R-...........F.W..N...==..X...j..%o.5F......x..,..d6/..J..^.......U..Sa..e....+..1..c......m.).^.q.).S..:....S<.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):6.2013416841671685
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOki64dcmi5ukzUqmiGWDQ2sxzgN+Em6hp/KEMlOZp:6v/7WdUE64dcUdiGE8xzS+Em63KEMlOX
                                        MD5:D4FF4FB8DD6E2BD2DA63DB2AD6F4AE7E
                                        SHA1:9CCD0C1300ABB0EB5909F1A7EB725B163FE545A6
                                        SHA-256:E8AE5A6A366AD82330ADB5C9A2ADF03C61584B8BFD3D56020BAA5CDBE2F42946
                                        SHA-512:58341C7E93A2DF919B8EEEFFD29F0FF8DA3714029A8B14A7A4A230EB9A2B18DE88C650C1F0C4246699FBEF7E6ADE520E275307E529178700980F2E6385CCDD63
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...^IDAT..c.....@.....Q&.U.?$..ob.n...0.7o.....Z2|Y..E...\.."L...>11./g.....&..%..g..f2.Wdx..^..... ......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):386
                                        Entropy (8bit):6.581871885288079
                                        Encrypted:false
                                        SSDEEP:12:6v/7WogU9+ihDVtRYJy/2zS+Em63KEMlOX:no19+ihDVteMezjEmdEMlOX
                                        MD5:8CBB1D31D59A19492034887A9727BC2D
                                        SHA1:A4A20C32539CDA455982CEB86BAED3571B742845
                                        SHA-256:0BF4E921028BDB28B10133B4EC93C298E18AC8E11181A3DD12645CF8A0B9F814
                                        SHA-512:B3F84BD0E92108AEF3F98A7BA6880590C404195D3A7E500F58DD918D81B614350927C4068379873FA4069D598B967D4132DB5B1C1645F2CA96706E2E03410A85
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(..1..P.D.SZ.6.M....!r.....K.J....F...f,>Ao.`.x;.,,.cs....p......>.uQ`.i%........S).~.....rV..=O... p..l...:]....Z......O....?.q.|....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_222222_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7025
                                        Entropy (8bit):7.929805003010536
                                        Encrypted:false
                                        SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                        MD5:23ACA9C182696DB96FF9EE5BF9601461
                                        SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                        SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                        SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_228ef1_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.758680832020893
                                        Encrypted:false
                                        SSDEEP:96:LNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:bHm231Nvu+wIqltWOe3nIP
                                        MD5:A9245423A8C7BDEEF75E74AFB9AA4F2E
                                        SHA1:5ACD9E5ABF06E470FE3AB6CA2C68928D73AA419C
                                        SHA-256:82657B8AF718436B5035B97B0680DB73BC71A49E6E85E90060333515DB23CB42
                                        SHA-512:B54475A9F9690E0D907B6B627F61E36C934E8680D594990998A33A756A3D79D9659D3FA7473E0303A179EB32123681BA049A8760CFA8152994748104ED17CBB2
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."....*....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ef8c08_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.773765613279426
                                        Encrypted:false
                                        SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                        MD5:5D1760802B4EBACA262C99F2E4C99E9C
                                        SHA1:A7194E4F70B0AF78478D4FD87996EAC871AE1B0F
                                        SHA-256:B68FBED9DB6CFDB2E895A583D02D70F84E3C6BD79DD6DF7D6CE4E269314649E1
                                        SHA-512:86F67F4EB53B85852964CE98B81FA4608AC319F14077865FF5E9ADBB58BAB686C4F805B90ACD26D026BB2075349668EDC65AF09AFA0CBB4F977C3641F530A1DD
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ffd27a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.762337567109736
                                        Encrypted:false
                                        SSDEEP:96:/kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4:/kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkY
                                        MD5:B1395D7A2A3288A98F8228E1EF360EC8
                                        SHA1:F9BC509291C758D04AD0EB9AEE287BF339C7EEC9
                                        SHA-256:0FA74A430333176F98075CCF436E33A020307586C76493C60B7F6FB111C1DCE4
                                        SHA-512:807401A623909AE49A0553D552C44C2F2C6A2A73E385C305F3989E7725BB2D124942325CD7293212B94D669B760675EA416F9687DD78869972231CF605BD6AD4
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ffffff_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):6487
                                        Entropy (8bit):7.90376532755891
                                        Encrypted:false
                                        SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                        MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                        SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                        SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                        SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36796
                                        Entropy (8bit):5.28435402116626
                                        Encrypted:false
                                        SSDEEP:192:10OW0k3b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHs+jVLlB:A3b/+vaW1e07BF5fyKEUDS257
                                        MD5:B7D9243F1C7B74709FCBCD7DFBB75E6A
                                        SHA1:6A89350F9A730ECBE7E3A605D24BA3CF86E03D55
                                        SHA-256:722982F556E40891116448DE1B410EDF8D448ED51E4D3EE00081A8D9E1DD72BC
                                        SHA-512:C6683EA031F7391C9DAC3EB0080B29C1AD327014C2A29385A30914CBE0BDC69F3A1C5DBA5C994941829D3BB92362B4FF32BECEC695AEB88A23B0C61B0BA13AF3
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOp

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29724)
                                        Category:dropped
                                        Size (bytes):31552
                                        Entropy (8bit):5.228356829465387
                                        Encrypted:false
                                        SSDEEP:384:A3lcR8lOXHc11evF2+BzImH+4G6Gz5IUSc7nfZBhVY:NXHcEDBzZTG6Gz5IEBhW
                                        MD5:D9A6894D9BF9260FD94A1E062A165890
                                        SHA1:0845DF32B854BAA93DFC63645F1B221114BD72E6
                                        SHA-256:37B2B6F30FC6719EBD365170AA229BD5DE585F2DFB4D27E076E8F9810EB1F26D
                                        SHA-512:35A08E1907BC6ECEFF0712699E1678B787F8A6C3079EAB02C47FE8E1DDC616A052E3FD18AFFF3EBD9D3CABAEF9971EE9373EE5BC9E9F44F7E808D1CAC7A77F7C
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOp

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1405)
                                        Category:dropped
                                        Size (bytes):18142
                                        Entropy (8bit):5.0948090465904405
                                        Encrypted:false
                                        SSDEEP:192:XO++jVLl/3F5fy9uCsEcI1/ePM2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhQB:XObF5fyKEUDS257
                                        MD5:02E006E56B3489170E1F53DB63E7EDC9
                                        SHA1:78FE0CC2E6A589A1991E91D1FC7A7F0F05EBED27
                                        SHA-256:BADDAEF2A6C7B3CFF023701084D1C01E827D534829B599C4F08C10BA0C249EC6
                                        SHA-512:E86DB4E092A72E76240A1BBC6B11187E817767580D6BD69B6FC0316D881CF8F7B3C7CDA940604FD7BA82A0424A906F0005EF44ED5A91CA3852DB3ADE198BF278
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=fbcb09&fcHover=c77405&iconColorHover=ef8c08&bgColorActive=ffffff&bgTextureActive=glass

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_glass_95_fef1ec_1x400.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                        Category:dropped
                                        Size (bytes):390
                                        Entropy (8bit):6.447437739895353
                                        Encrypted:false
                                        SSDEEP:12:6v/7J1r+U9+jwk1em+2vEKvEA2zS+EELEMPS:krr9+EAvEJA2zjEELEMPS
                                        MD5:B64DE8410FA1D3A00CF2B1E9CCFB1258
                                        SHA1:A73D3BD96E2851565DB2F68DC4023FB6FE3FF204
                                        SHA-256:F1E63DDA49891B14FDEC86F5E76C606C89C249D272BFD03CEA169305752E73E5
                                        SHA-512:F052A9CF6D427482BCF8F9C59F8591C8F295D09238DCC9E709F9E39AD54BCC1E4D2708FC05F6CD6E2130A290E2287ED742B6170130030C95F1981E0909A9614E
                                        Malicious:false
                                        Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_gloss-wave_16_121212_500x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):4031
                                        Entropy (8bit):7.9028350895565165
                                        Encrypted:false
                                        SSDEEP:96:fNfyjyimoWx1aaf+xWkKCce0IBbsRQ0zIKJnQc5buTWliW:l9Zt6WkceNBbsKeHZl54WL
                                        MD5:39EF50F09E2809D49B8C00039CED3155
                                        SHA1:8DB6F2EE92A24C760E08590C9AEA79A7CB8FB848
                                        SHA-256:D98A434962B17AD62B8EB86FB75A5D2F2CEF2FE1ADAAC616FC79AC158519A5AD
                                        SHA-512:4527070C6C523C9BAF4C36FB650C7F0EEF1A21A3DF5238BED51200F1152B8F02DC66C5262AF8EAAC51A8DA53EB5C63AD0506A3B28020697CD4CC2D7EBC301629
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..]..$G.~....-...|..].H...@.t...I$H.&C....H......@\@....s..4.!..,..3.`g...UW..y...'.lOu..Y5]U....... ..'... .W.6t.X....b.`C'..... V.6t.X....b.`C'..... V.6t.X....b.`C'..... V.6t.X....b.`C'..... V.......+U..j.VE.n?k..)....+.....xW..S....Bu|4..%.G..H-G..,?.1m.h....M..*.f.!..`...H..sW.na.._...x_....^2....`?.\e....q..]..'...N..S....'^..Zw..@..=..3.u.L.)....Fr;.n.-9....(g.n.E.G.g_....I.y.d.../.......R._.A.G.S..Z.. ^58.N.+..:A...Re..i.>H.A...".k.......XB..dOy.|-7-...R..:.....ZG<-..A.m..I(..R$."....R.f|.g.........~.......G.>...._....a.8.i0.. G.4..[..7dG-..d./. 2...-Z.b.U.........O=..+..7..M.Q..kK}.A...4..m.q.?J..Me.VS......S5..]+..{W...=.e..M%<4U_W4.]/.5...4..........v..........9q..b..5A.6.....1...I.....q.8].. .k.N......N.+..f.b.... V.v..b.8m..?O..+.V.|.A...>..ZA.(....`.P........T3.Pn....].6-kg..@..f..^CGm.m.c.........;....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-hard_15_888888_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):311
                                        Entropy (8bit):5.963006320820522
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/hWwaR7znGQ8zgN+E8VLEMlVbEbp:6v/7WdU8Q3GQ8zS+EELEMPS
                                        MD5:DBB10EF01FC9FF253FCDAA4D502DA438
                                        SHA1:D66A5B34D620576FC79C9A8A1E6F1E16D86AF410
                                        SHA-256:63CC98C1D36765DF5D7D186773D10E4EFE41DEEDE80A211D62157D7D94672963
                                        SHA-512:D4B7BC8781473E26898B2E1498A1F2AC36B29353C179FA651A381AC77B75E22ED477BB3BCC7A9C9414F5170539053EA04008EB8336927368E73899B8850D9530
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......?IDAT....A.. ......>.......S.^....2HF..$.|......6l.....y.>C......=.u....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-hard_55_555555_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):311
                                        Entropy (8bit):5.8924441889538794
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/hPHpKIzgN+E8VLEMlVbEbp:6v/7WdU8PHprzS+EELEMPS
                                        MD5:53626545F7AAD27A50909EB0FCF5BDD8
                                        SHA1:3AAE3D8D43A7B3E082CFF70E980760AC5BA6B3E2
                                        SHA-256:C20A901E1AEB67A3A73BC491285DF74AA29968A42C1FC2922BF0D60B5821B1BD
                                        SHA-512:9A2A72742DD65724849419A8F87F9D3AEC113A2E3B30009EE564962E8F415FC1D5C1B778D5A792D60992DF07DF11BF5DD07562965A7CF4AD4CE5F187ACF4C75E
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......?IDAT..c.]...0ph!..L.60....g..os...L.o0...e....7.........N.&... ..qz......%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-soft_35_adadad_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):326
                                        Entropy (8bit):6.061424992259731
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/skdptAGvHbsrpPQfzgN+E8VLEMlVbEbp:6v/7WdUAsGjs4zS+EELEMPS
                                        MD5:E07630E0B48EC08F0FF665666C6B6E4D
                                        SHA1:79E5622B1E1207D0C45EAAB8ABB61084DC828280
                                        SHA-256:250FE740209C0879C091AF3452E8D7036D97AB24D2CA698F133FD207608B7337
                                        SHA-512:034260637492FBC28756FBB1D306BD3490B3AD15A8A7D6CADF87AADD3CA0F7E9AED747EF4B4CD300B7915F9995949728ACCCDD6F199351B7B26CF2A7AF7F15A9
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......NIDAT...1..@..7.D.;..'......D.,.t.L1....B......w.xA..7.>.|...-U.k..:.....;....=....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-soft_60_dddddd_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):342
                                        Entropy (8bit):6.127798978260897
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/oZ/OMpxD2zgN+E8VLEMlVbEbp:6v/7WdUpFbxD2zS+EELEMPS
                                        MD5:9AD2D7E521846940F3869A9E4F73C380
                                        SHA1:DF24CC6F8682C785CAF0D48F3D29731068F9EEDE
                                        SHA-256:C74EFD53A0F5365611439393F36B7A8F2EA5E600BBE6188C7CF384EA407BBFFE
                                        SHA-512:68E7C6681411D8F7E48D1E4AABBE7D8DF5B6FB7F98951E738FDB095577BEFFF2B687D451A91ADDF2046A283C24F1A64E70A2FF1EC87D8C4B580FEBAC1D398032
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......^IDAT..cx....@.....L..../.1.Hbx~..3........0<9..D...4.......0<x..P.p.>.}..{/..Z..I3.?D/.bA...!..@W....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_inset-soft_15_121212_1x100.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                        Category:dropped
                                        Size (bytes):322
                                        Entropy (8bit):6.09678954068526
                                        Encrypted:false
                                        SSDEEP:6:6v/lhPedUyKOkp4/bTe9X+EsoZ7kbzgN+E8VLEMlVbEbp:6v/7WdUiTe9XFJQbzS+EELEMPS
                                        MD5:956014D41F5BC21A2C79090E1DC83D59
                                        SHA1:E8FB0A5D917390E211261CF172A95A8B2E06291D
                                        SHA-256:E394A321626DCFF17847269BD861229BCFE6F09CDE8922CFD35608125E6ADE09
                                        SHA-512:03C95D321B7DF9D8815551628A044ADC95D2AFB386481BB6ACDF4C9711673ADAF1B05C57B4A2C30C44A02252A6F2BF8AF03918A2CD46E4FDF6C3BF76D7A3F6F4
                                        Malicious:false
                                        Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......JIDAT....1..@.D....-.m..v..b..%..*,@..<....C..N\x.......rC..w\.......l.L..P..t#...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_666666_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7111
                                        Entropy (8bit):7.928455943008907
                                        Encrypted:false
                                        SSDEEP:192:eMzXuohHXyFN1Ce1gydd84kWORcDrbeq3ek:79HXk1t1gMd8WOkrbeUek
                                        MD5:D779CF92249EF61590F0B6FA32207423
                                        SHA1:5D0223055783B026D13CCF508FD54317B030981E
                                        SHA-256:18257A1FC35E3B8C129E2EE60DA4B617703FE80E43F8D8F3052614BF7AA8CABF
                                        SHA-512:440349B6C97F034C635D731A128EA0A637867EA971631B7A0F4835EB92FD2B7F892B1AFB9CAF78681FE36EACAC8C179793159A29A2052B0F561295C359B31B36
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.f.\._....tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_aaaaaa_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7075
                                        Entropy (8bit):7.9303849833121305
                                        Encrypted:false
                                        SSDEEP:192:UXTvYXQzy0RbWcAt87YE84ate0UEXUj/SPoH7:Ux1fS87YE2e3E4/6ob
                                        MD5:576B05CC7D15F49E870CF358D041772B
                                        SHA1:9E461C8365CE53C0DD69BF01FD3E08C15E893CEE
                                        SHA-256:36CEFEEDA29F3528EEFB7595CCA0E15E9624E7746F0F19A66EA099CC3B4833BA
                                        SHA-512:492DD4EB32D24FE2ECB33C1716D850135ED17B8C928F114837587A5AE0FAD3191A51946AAF9957411B1AC17363BAC33291EEABE53B0A24A327DFBFDB9D7FD1EF
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....i.....tIME.....%...'E....IDATx..{.$G}.?m;....!.>...l.0.][..HX.M.K....E.....)r.8...{....?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W..<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_bbbbbb_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7092
                                        Entropy (8bit):7.923076697213992
                                        Encrypted:false
                                        SSDEEP:96:+bdL0XdnQW8FLZ3Iz6QlfUGxGO7TjLZxkSR5jsUeuOkjFWr4n2Otk54c+tEBNrDb:ykSFt+7/xpT3Zua5gewr4smcZrDaIx
                                        MD5:947F1A81E0EEECAD8A78B92B269E3C2F
                                        SHA1:4ADACD01B707EAF141426B565937D0651EE0F808
                                        SHA-256:748E923944BED881A8384BD8F6A90D83BA56C30B3FDA34E77A3A2EB3381518F1
                                        SHA-512:41C5907FA5532A13490E462CB9D5218FF06CC8B0C40DD29FCFD4BA55FAC3225D0B13A55900A3CD77B6ED36996A003D52C63A90622AEF6DB6353009892A6BE1B2
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...>I6....tIME.....%...'E....IDATx..{.eE}.?.H(bX.1..[P.`....J.H..Ef..M.b...F....,.3...`V.;..!.]..E.<.K.@U.#"..-.gWEBL"8+qW..q.#E,9......9..w....{..u.........u.(.M.i..G....... .EH...Hx...2..$........+.\.....8..................FOoi...3.Z...W".0.<D}DV.....B.7n..Q'.....+.....q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3`.J...[.....Z...S0.Ms..}`.....T(/.f.}......<..)...]D..`....0.../..._.l8..4.^.../........@................=..E.M..2....`gO.{..:\.}....=....\.z...\..mc.-...>....(....W..P&}..n..b.`.....f.Q...P@..P].Xq...a.............jmP.I..U.A&..........%..`.._9u.......W.7.~!.....px.h8..4.^.../.......~g`...q...Zi...Q/zO*..9..9......C..! .....?@X.R.U.a.`}`L...Uc...%T...I.l.......8T.K.B...%...&..{FL....f..-.....g.....u..t.....H.(Z'.a.;PR.OW=%n^.<...9.t.f..e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..f..c/.<...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_c98000_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739641524249667
                                        Encrypted:false
                                        SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                        MD5:3F3E1F1DB74D1AFEF12705208908F54E
                                        SHA1:D11DE5DAF044246304F892AE14BC11929467D537
                                        SHA-256:98A8B1A6BFA2BFE849A2B5218A12B0BF89DAF37C0CE965B706BAB11D01CFDD76
                                        SHA-512:84587950460A23FC3A9DB512B0D4D67C6B457DF84E4DDCDB5E58285C0584A37ACB51645570E5D7E5388A6830734FDF67DA02F057A2CCEB11D044864BCF166A77
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................F5r....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_cccccc_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                        Category:dropped
                                        Size (bytes):7034
                                        Entropy (8bit):7.932139241999848
                                        Encrypted:false
                                        SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                        MD5:883030509884C748B039641F5955E85C
                                        SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                        SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                        SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                        Malicious:false
                                        Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_cd0a0a_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.739814671431308
                                        Encrypted:false
                                        SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                        MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                        SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                        SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                        SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_f29a00_256x240.png

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                        Category:dropped
                                        Size (bytes):4676
                                        Entropy (8bit):7.7508488222392184
                                        Encrypted:false
                                        SSDEEP:96:cg6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:cg0Hm231Nvu+wIqltWOe3nIP
                                        MD5:E05F6591588CD86BE9D6A498A5EAB45A
                                        SHA1:5BCC7AA52043087C1BE8D139E21E38D6F788B572
                                        SHA-256:ED4D5B2DFE4CD278A8F797F68AE75A40EB186FCC932D30A85EE4A7491635191D
                                        SHA-512:87783EBA19C69FFC36E7BF7199EF2EAF1FDD7AFC2B1D7BA24A9B20483CDABC81AA7458D19560C69D3EF7A14653B2454524CB99A3003CB43CAF3F85D9FC5BBF8F
                                        Malicious:false
                                        Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.........................................................................................................................................................................................................b.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\jquery-ui.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (2363)
                                        Category:dropped
                                        Size (bytes):36432
                                        Entropy (8bit):5.2687503977040855
                                        Encrypted:false
                                        SSDEEP:384:BNynb/+vaW1e076F5fyfEVDS25Vc6Kvlak:mGP7wDS2vc6Kr
                                        MD5:498FA98DD64941C89E7F4B3D1C80C9A5
                                        SHA1:7915CBD12C96C14602311920A64FB2D0B006C634
                                        SHA-256:D15D714E3DF34F5FBAAE39857941A05315A6CF2F7BD0ED547649EC3F6D1FB80A
                                        SHA-512:7A42EBBB122906601399A4861C653645D5DAD0B27E99E47D9448FFD971296716500E2A16C7D94AE0539C1419847BBBF93BAA32D20D61D9356038FAB0CA5F8745
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityH

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\jquery-ui.min.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (29605)
                                        Category:dropped
                                        Size (bytes):31158
                                        Entropy (8bit):5.210561486546047
                                        Encrypted:false
                                        SSDEEP:384:BNynlcR8lOXHc11evtRzWmni+4s6GxlElSc7nfZBhVBWGc:fXHcEtRzLnSs6GxlEDBhQ
                                        MD5:65B8A4440ACA66315F32B3D942F89561
                                        SHA1:6F9F79ADB2BB1E55AEF68C17EDA5ECC3E2FC3E4C
                                        SHA-256:12B16CA33D3957B5F89BE9F5E2E8FDF444D1DDE91C3D63122BE11A0731A5DF14
                                        SHA-512:68E6350CCA7F10E86648802E24522CAD7467936C12AD407B04AE71F875379DED132332A29C49228849C88442D46E0B2650353B53D60E3454A78F08D1A17EC65E
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityH

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\theme.css

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (1130)
                                        Category:dropped
                                        Size (bytes):17778
                                        Entropy (8bit):5.058569194973011
                                        Encrypted:false
                                        SSDEEP:192:XLNyD9Mte6NF5fyjPBqcEco7xqDNYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqcN:XLNy4F5fyfEVDS25Vc6Kvlak
                                        MD5:9F76BFD262C02609A1781985C10DF2F6
                                        SHA1:9237E5ADD22EF6D14D6E57C224D5DA817E198101
                                        SHA-256:1413A4DBB8960D4CED5A71F06C31064A41ECBD2AB08E0B5438403207A274B47A
                                        SHA-512:8F30C2BD6F9AF99E13CEF3F97D44209AD330572332451274FF10CBE36E850608F1DC4637422283F2B5BDA0F37F056D5EB54DD6F4658EFA423B47A11B322D801F
                                        Malicious:false
                                        Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityHover=60&borderColorHover=dddddd&fcHover=000000&iconColorHover=c98000&bgColorActive=121212&bgTextureActive=inset_soft&b

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\jquery-ui.min.js

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (32073)
                                        Category:dropped
                                        Size (bytes):253668
                                        Entropy (8bit):5.1428695015347285
                                        Encrypted:false
                                        SSDEEP:3072:FkHOJD1g7SV7opRBXDrtnAcKYvFJi/5PLO1aG0qF2/nwOW16j:qp/KvjOVlFYQ16j
                                        MD5:0A497D4661DF7B82FEEE14332CE0BDAF
                                        SHA1:F77D06B0C5DEDEF1F1DB051A44A2B0D7F233BA3A
                                        SHA-256:55ACCFF7B642C2D7A402CBE03C1494C0F14A76BC03DEE9D47D219562B6A152A5
                                        SHA-512:E036A2057F2BB203A805234B71E43F222C4317EB940D5D2126B417FCC27D470259083A9B129D048C8428746C6CCCFB53A7095E9C9CE74768E48035AA8F81ECF8
                                        Malicious:false
                                        Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js, focusable.js, form-reset-mixin.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable.js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, widgets/sortabl

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\payserver\www\vendor\qrcode.js

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):56694
                                        Entropy (8bit):4.735778390117143
                                        Encrypted:false
                                        SSDEEP:768:pRAGaUobYVVPh7Inoh7SlSKrnef8mLtEYbNyfPVrhZv9wy0aQiCIHjCg9/GAgwho:BaUo2Yoh7SlSKrnefJSY5yeac
                                        MD5:6E6189E2B177B3D014321EDAD68FD73C
                                        SHA1:4C79BE1679603EF9691B98A90617AA1E534E93EF
                                        SHA-256:18AE399F81182BC9DE916E9C77B195DF20CC58D6F2D55A62B085A299F1BF1780
                                        SHA-512:E96386EFA01773CAE582D1982C684383B948CD91B609CF95AD26A6BE0A5E0588316AE1AEA0CB9AEAE2A59783AC67426F552B75DA5457FFDB82997CE4B77FF07E
                                        Malicious:false
                                        Preview://---------------------------------------------------------------------.//.// QR Code Generator for JavaScript.//.// Copyright (c) 2009 Kazuhiko Arase.//.// URL: http://www.d-project.com/.//.// Licensed under the MIT license:.// http://www.opensource.org/licenses/mit-license.php.//.// The word 'QR Code' is registered trademark of.// DENSO WAVE INCORPORATED.// http://www.denso-wave.com/qrcode/faqpatent-e.html.//.//---------------------------------------------------------------------..var qrcode = function() {.. //---------------------------------------------------------------------. // qrcode. //---------------------------------------------------------------------.. /**. * qrcode. * @param typeNumber 1 to 40. * @param errorCorrectionLevel 'L','M','Q','H'. */. var qrcode = function(typeNumber, errorCorrectionLevel) {.. var PAD0 = 0xEC;. var PAD1 = 0x11;.. var _typeNumber = typeNumber;. var _errorCorrectionLevel = QRErrorCorrectionLevel[errorCorrectionLevel];.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\DejaVuSansMono-Bold.ttf

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:TrueType Font data, 18 tables, 1st "FFTM", 22 names, Macintosh
                                        Category:dropped
                                        Size (bytes):331536
                                        Entropy (8bit):6.789741149323993
                                        Encrypted:false
                                        SSDEEP:6144:l2Y6/fJe6mrBD75NsETSDXE1u7I4fEZZ20eB/JGZHm3:l2YQ1mrh78XEU7nfEZZ27B6m3
                                        MD5:FB4EC87D51DDBE7C5D2F9E8F09D7E39F
                                        SHA1:FF23758A6E42BACB4C02813603E5E12AD5AEF30C
                                        SHA-256:BAADA9A5172FE20886251AFF0433FC38461912D5DAF07287E7BEE56620A8DA96
                                        SHA-512:272B8B31B21904DF61198311F6B803CF796BA26B65DE5EFA2530924F270E2FDC0AB888DA78BAE71C38DB805C5E43BE91FF81050594EB6A889E35F1C33E3C2F04
                                        Malicious:false
                                        Preview:........... FFTMo9.....,....GDEFd.W....H...tGPOS:U-........\GSUB.\..........OS/2.&...." ...Vcmapdi...."x...6cvt .I.*..8.....fpgmq49j..:4....gasp......:.....glyf...F..:....head.u.........6hhea...........$hmtx............loca..t..9...3.maxp......m.... namet4.j..m...!Bpost.K........{0prepLQ.3.................=.......}.......}...........l...................................u...v..............................................................................DFLT.&arab.0cyrl.>grek.Plao .\latn.h............................SRB ...................................4..ISM .4KSM .4LSM .4MOL .4NSM .4ROM .4SKS .4SSM .4..........mark..mark.&mark..mkmk.4.........................................$.,.4.<.D.L.T.......H.......n.................................................................".........j.............{.........j.....&.....0...........j.:...j.......|.......y.z.}.................j.Q...].j...j.h.................$.6.H.Z.l.~.............P...<...........x...................P...<...........<..........

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\LICENSE_DEJAVU.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):4816
                                        Entropy (8bit):5.077864397875037
                                        Encrypted:false
                                        SSDEEP:96:mGMeXeAJiP/hS6c4UQHDoCr49rK9eA5KPQOZQe1DcsGQHSBZoGrDebc:m6Xic6c4UQHDFr409OG+csGQHSflrj
                                        MD5:9F867DA7A73FAD2715291348E80D0763
                                        SHA1:23E8FED3E3499427EF5A80CBFF0ACA0946140493
                                        SHA-256:D75938DEC098F06F0AC3C00853065D94F020BE1C3C62EF1DC2975BA15B4D9B0E
                                        SHA-512:7510D6187016069096A33D88DB3B1144B6418362604CBEB8EE32ECA4B2BB854E9043F666078521FC9772985864AABFFFFF62680A8A49ECE89AFA33436F4DB405
                                        Malicious:false
                                        Preview:Fonts are (c) Bitstream (see below). DejaVu changes are in public domain..Glyphs imported from Arev fonts are (c) Tavmjong Bah (see below)..Bitstream Vera Fonts Copyright.------------------------------..Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is.a trademark of Bitstream, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of the fonts accompanying this license ("Fonts") and associated.documentation files (the "Font Software"), to reproduce and distribute the.Font Software, including without limitation the rights to use, copy, merge,.publish, distribute, and/or sell copies of the Font Software, and to permit.persons to whom the Font Software is furnished to do so, subject to the.following conditions:..The above copyright and trademark notices and this permission notice shall.be included in all copies of one or more of the Font Software typefaces...The Font Software may be modified, altered, or added to, and in particular.t

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\SIL Open Font License.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with very long lines (591)
                                        Category:dropped
                                        Size (bytes):4525
                                        Entropy (8bit):4.9314245287864855
                                        Encrypted:false
                                        SSDEEP:96:3hn52iBCxwDXFeyKnjNXiSJ2lAjaFz+PPvcyqqlQHRoh:32uC2m0SJ2lA9PPfQHRq
                                        MD5:6A445E3B469CBC2637D00771A19D63FA
                                        SHA1:015CD2F6BB6E7049412B176B2BE4C41A63A2ACE6
                                        SHA-256:D73F22C5F15342B572FEE0EF98FF7FDFA8CD3832CB37EFF44B0C6FFE3BCD96E2
                                        SHA-512:8880B24D74D4ABB14149B81597B39DA0606216AF55C9989D376050026405859807534EBEF7506A6A0AD0F6829E6741934A7C70E1FE9569E88A7F818C6C74252D
                                        Malicious:false
                                        Preview:Copyright 2010, 2012 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe Systems Incorporated in the United States and/or other countries...This Font Software is licensed under the SIL Open Font License, Version 1.1..This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL..-----------------------------------------------------------.SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007.-----------------------------------------------------------..PREAMBLE.The goals of the Open Font License (OFL) are to stimulate worldwide development of collaborative font projects, to support the font creation efforts of academic and linguistic communities, and to provide a free and open framework in which fonts may be shared and improved in partnership with others...The OFL allows the licensed fonts to be used, studied, modified and redistributed freely as long as they are not sold

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\SourceSansPro-Bold.otf

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:OpenType font data
                                        Category:dropped
                                        Size (bytes):235128
                                        Entropy (8bit):6.369530846550487
                                        Encrypted:false
                                        SSDEEP:6144:Ao7OQyeiLLF2uajmLJnZXP8eayy+HSSTVv/Ihp:ACOaiLLeofyeYp
                                        MD5:1A2A157BFD94B250884C09F1BD57A0BB
                                        SHA1:F4D98C36159F7CF22BA1966B94598D4E88C57C33
                                        SHA-256:9B8BD174F97413334E317BE808D14D0FF8F6EFED79A69299D84384C7E10E9312
                                        SHA-512:2381D87FE9D3C1034C73E64573E55E2B1306B48CF26439F574560E4F3FDB1B2EBC28A04A160376DFED965D8A6068DDC40357BFDE861A1A987352F3443D14BD72
                                        Malicious:false
                                        Preview:OTTO.......`BASEe.]...}....FCFF .)s4..Dl....DSIG...)..}`....GDEF..z..<.....GPOS.{....|....TGSUB...+..@h..<ZOS/2_.....P...`cmap.<.5......6^head..zu.......6hhea...U...$...$hmtx.c.....L...Xmaxp..P....H....name..h........<post...2..DL... ..........._.<......................7...m...........................7.7.m....................P........,.........X...K...X...^.2.)............`...............ADBO. . ............ .............. .....$...........p.............p.....................#.......................8.......................`.............d...........~...................................3...........M...........Y...........c...........n...........y.......................b.....................F...........(...........p...........$.f.....................4.J...........~.........2........... ...........4.........................4...........H...........^...........tCopyright 2010, 2012, 2014 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name .Source..Source Sans ProBol

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):338
                                        Entropy (8bit):4.976373651046497
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhizUooAecRHleZekrytS4yFRlEU8oVmTq+askR1TFaHXZQGVrIr:1YvQJiz1RWkSrG3O9dR1TUHJQGV0r
                                        MD5:A46F07365C49838A07A263378E6FB8B1
                                        SHA1:3C5AE47FA123862EAF86B5A5A9F36FAEB1643D94
                                        SHA-256:1989DF20ADAB8D133B103E417CC4203029074C4E8F43FBB3530A10691907BCAD
                                        SHA-512:D2C381AE593A09B60C4C4EA123364394E6D88374771B03ED5FA580B069AC113A40D34AAA65F6D74118AC513DE2DD3A7BF636F8AFDC964648524FB3C74AAF52D0
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('Revealer Backup Utility').description = ''.join(["<br/>",. "<b>"+_("Do you have something to hide ?")+"</b>", '<br/>', '<br/>',. _("This plug-in allows you to create a visually encrypted backup of your wallet seeds, or of custom alphanumeric secrets."), '<br/>']).available_for = ['qt']...

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\hmac_drbg.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1826
                                        Entropy (8bit):5.120325552455995
                                        Encrypted:false
                                        SSDEEP:48:raJHlxE35QHOs5exm3ogF5Ie6mdTCG+zVwJu:eupQHTo86ZGu
                                        MD5:D5013CD088CA262AED345AD253C661CC
                                        SHA1:B6A887E25EC2E7AD91D095B0FA71E360FEDDC676
                                        SHA-256:EBADC22762FCC44BD99903D91380C7E39B7791EF0FC848819D9B649BFC43FD0F
                                        SHA-512:8CD0D87F2A3D79688E2037D78218C25B6A7D9D8B12AA6BF853199C28A52B65200E4CDE6F0730F96DA2497D2E183CF88A630E5EB22D0059165E48F4B9ACDBF9E9
                                        Malicious:false
                                        Preview:'''.Copyright (c) 2014 David Lazar <lazard@mit.edu>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):38721
                                        Entropy (8bit):4.634066084919751
                                        Encrypted:false
                                        SSDEEP:384:J957z2ZJuFgOOklFHQWX00yZ9oa9QW/JCVahuknRRn4NYnokuMhNZ7bZMeHq8EzR:JjRnwzLoa9QW/JCGl5bt5C3
                                        MD5:33235D89C19356BE0118D4604254A0BE
                                        SHA1:5CC071915FF2BDC4EC64E88EB47341574C709BDF
                                        SHA-256:169E93438B45725D693012D071863B6C78B880EC48DA2052A4CC7B8875B00483
                                        SHA-512:EA574970B5AD07F913CBF5BE9BE29ABFBDD5E4C72CBFA60CA2B71854E107B7536DA3A04B27CD66B4022201943C6F94B5740B636D78CB56D9320E56A27EE083C9
                                        Malicious:false
                                        Preview:'''..Revealer.Do you have something to hide?.Secret backup plug-in for the electrum wallet...Copyright:. 2017 Tiago Romagnani Silveira. 2023 Soren Stoutner <soren@debian.org>..Distributed under the MIT software license, see the accompanying.file LICENCE or http://www.opensource.org/licenses/mit-license.php..'''..import os.import random.import traceback.from decimal import Decimal.from functools import partial.import sys..import qrcode.from PyQt5.QtPrintSupport import QPrinter.from PyQt5.QtCore import Qt, QRectF, QRect, QSizeF, QUrl, QPoint, QSize.from PyQt5.QtGui import (QPixmap, QImage, QBitmap, QPainter, QFontDatabase, QPen, QFont,. QColor, QDesktopServices, qRgba, QPainterPath).from PyQt5.QtWidgets import (QGridLayout, QVBoxLayout, QHBoxLayout, QLabel,. QPushButton, QLineEdit)..from electrum.plugin import hook.from electrum.i18n import _.from electrum.util import make_dir, InvalidPassword, UserCancelled.from electrum.gui.qt.u

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\revealer\revealer.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3559
                                        Entropy (8bit):4.545874647248047
                                        Encrypted:false
                                        SSDEEP:96:a7iFbsTt5NqX0lNx0IYqWGxc10M6ZeeneBbriKmoY/f8SeDh:Iiy5400zkeenQuveN
                                        MD5:2B64D9140F5EFAE125B249C28EC2BBBA
                                        SHA1:AB7A1EB80DC0586AA79F5EAB4B77B9ACD8A0D275
                                        SHA-256:49D230C7A399DBC2067E567E9C7B7D9AF50DE99CF3211A6350700AF4E17ED007
                                        SHA-512:A16ED1DE561ACCF8574870022851AADB99C0CD8C442D6323814AE2C27466D00BB38C5D1FB33595C071D68E91EA282DE30EE61352D7868A546C89EC731A21529E
                                        Malicious:false
                                        Preview:import random.import os.from hashlib import sha256.from typing import NamedTuple, Optional, Dict, Tuple..from electrum.plugin import BasePlugin.from electrum.util import to_bytes, bfh..from .hmac_drbg import DRBG...class VersionedSeed(NamedTuple):. version: str. seed: str. checksum: str.. def get_ui_string_version_plus_seed(self):. version, seed = self.version, self.seed. assert isinstance(version, str) and len(version) == 1, version. assert isinstance(seed, str) and len(seed) >= 32. ret = version + seed. ret = ret.upper(). return ' '.join(ret[i : i+4] for i in range(0, len(ret), 4))...class RevealerPlugin(BasePlugin):.. LATEST_VERSION = '1'. KNOWN_VERSIONS = ('0', '1'). assert LATEST_VERSION in KNOWN_VERSIONS.. SIZE = (159, 97).. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, config, name).. @classmethod. def code_hashid(cls, txt: str) -> str:. txt = txt.lower().

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):299
                                        Entropy (8bit):4.87862334366989
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhsrMv6IFQVR1OMCHZ8iWUl0MACwKNQo6KC7V44WGVrIeCM7iv:1YvQJAS6DnOx58W0t2C5uGV0dM+v
                                        MD5:343121E1057A6FC48EC3C10A58D773EC
                                        SHA1:13B5D7FD4B839D74221A251647EB2AE9EAD318E7
                                        SHA-256:DD7FFFF8D2DD5E073CA708875E3DB16625AD5ECA0C9D3E1702A714384C6BF096
                                        SHA-512:7F220F35EFB066FA5DBE94180785F14F53B024774030E86A186249D3CB39CB98BEFB90C218A144F2771B5F4F0C6ADCF3CB4DC52D2FFD023C356CB0EA0E3C465C
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Safe-T mini Wallet'.description = _('Provides support for Safe-T mini hardware wallet').requires = [('safetlib','github.com/archos-safe-t/python-safet')].registers_keystore = ('hardware', 'safe_t', _("Safe-T mini wallet")).available_for = ['qt', 'cmdline']..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\client.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):437
                                        Entropy (8bit):4.559059320330288
                                        Encrypted:false
                                        SSDEEP:12:1xRPRXZI6FDd0zjDdoI90x1AF9AVnIyAVlDA6Jq1Vy:1x3/CzvuAF9ArAPA6Jqi
                                        MD5:5944759562DC7E18859E3C5B7A21BB40
                                        SHA1:A54A0F9614D768D02F4E671653988286725CE330
                                        SHA-256:BA33F2F015236FBBCD6D41F9B8E4E3CAB69464F119C53D7EB0D9B812AB3B189B
                                        SHA-512:CFA7ECF995DDEB7B0DAC502DF224938463DD3AD53D47212366EFABAF110E06419069839168F5E95EFB5388F5040A49B71C147AD9496C4C20902E946BBC19902A
                                        Malicious:false
                                        Preview:from safetlib.client import proto, BaseClient, ProtocolMixin.from .clientbase import SafeTClientBase..class SafeTClient(SafeTClientBase, ProtocolMixin, BaseClient):. def __init__(self, transport, handler, plugin):. BaseClient.__init__(self, transport=transport). ProtocolMixin.__init__(self, transport=transport). SafeTClientBase.__init__(self, handler, plugin, proto)...SafeTClientBase.wrap_methods(SafeTClient).

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\clientbase.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):10178
                                        Entropy (8bit):4.5253358235227354
                                        Encrypted:false
                                        SSDEEP:192:C488tMUvff5J11Rku28Alve/h2B0oyCGOAiwvt:28tjve/+2WoyD5b
                                        MD5:8D278A0B2B3B0C665BD311F17878A3F3
                                        SHA1:D6BA80C0E077B09BD00713578A3FABCA777C035E
                                        SHA-256:F79102D2776453454990CC4A28BD1A8ED69B54B0AD783F0024464AC21E659A30
                                        SHA-512:05D59F95D4A91DAE2922F8A460F68E7686F95C6156B8F55F407B083D141C7CAE847FBF7FF0BEA2EF3E74A0EB7FE3A3DD2575C2286BA61485DD6E752893AC75A6
                                        Malicious:false
                                        Preview:import time.from struct import pack.from typing import Optional..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import HardwareClientBase, HardwareHandlerBase...class GuiMixin(object):. # Requires: self.proto, self.device. handler: Optional[HardwareHandlerBase].. # ref: https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.proto#L89. messages = {. 3: _("Confirm the transaction output on your {} device"),. 4: _("Confirm internal entropy on your {} device to begin"),. 5: _("Write down the seed word shown on your {}"),. 6: _("Confirm on your {} that you want to wipe it clean"),. 7: _("Confirm on your {} devi

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):396
                                        Entropy (8bit):4.478728505749281
                                        Encrypted:false
                                        SSDEEP:12:1KM82qFD5+85jEI2Hvsb/aCTATSvehahBNA099a/:1/KcoE3Hvsb/aC9sahfA0y/
                                        MD5:86DAE1F1ED0C3C4188E9A432E0E86B5F
                                        SHA1:B6157EA178F5F84201EF1F299DA9473CB21E4C0F
                                        SHA-256:9CFBA2C4F909B87CBD9493F72FFFF4A2D8B3870759B77D84B02DAB2ABF761F57
                                        SHA-512:55DBF9C52BFD4A2EDC40705FEB5F8CBEBDB92449396C772EF24AD5BDAC90C2F4CFA77CDC0CAE71DBCAA12EC7DE56C8E9ABFBFCF458F1295947775512AC99A8D9
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from .safe_t import SafeTPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(SafeTPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):26464
                                        Entropy (8bit):4.609627644960407
                                        Encrypted:false
                                        SSDEEP:384:euq1cnVcNjxHyTWYO0ZF2lvVSjlmmvi4yL6OaoJa4z1MukFviY17rBF:riyTrV2lvVSjlmmvi4yL6OaoJa4z1+Rz
                                        MD5:7830105DEF4B9F5F05533A620B834FD5
                                        SHA1:32D2BC511319806D569EEC399E1ACA1372715525
                                        SHA-256:249B34862EA38C1E24D5A0B39F29F8211FF49D8448B32BF71C389871B8DD16D7
                                        SHA-512:40C2F090A085C201807AF1A6360FE476B8BF4CAC00270BB948A2FC9201309989810196DF4E56C7AC320FD9E06AADC3FBE7C9DA335094419CBE61764755B5FD1F
                                        Malicious:false
                                        Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, pyqtSignal, QRegExp.from PyQt5.QtGui import QRegExpValidator.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox,. QTextEdit, QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QFileDialog, QSlider, QTabWidget)..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, getOpenFileName, ChoiceWidget).from electrum.i18n import _.from electrum.plugin import hook.from electrum.logging import Logger..from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from .safe_t import SafeTPlugin, TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY..from electrum.gui.qt.wizard.wallet import WCScriptAn

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\safe_t.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):17484
                                        Entropy (8bit):4.4774263925224265
                                        Encrypted:false
                                        SSDEEP:192:4vInEP87zX3kMaWn0Erq7ZaQUdmADh3h4qb1vlzoVODrwTcaCkjmc3Y5FCKBJ:OuEE7zXab5A11X4TRpS465
                                        MD5:9777E76D4BB43B3CBFEA37E17AA027D3
                                        SHA1:AFB13514441386BA154C625E5C3DB106F54FFC3B
                                        SHA-256:0D1926DBF570BBEDA5FB036EFA1E0C7415AA292AA196E2511AA85563CCF39A72
                                        SHA-512:D891333E8401EBD861C63398763936E90A59057DB8E27373766B4952F116518B058EB087EA8E11BE5B57E3E5AD6524E1C6D3421EA33B81BA2FAA759CDA798C44
                                        Malicious:false
                                        Preview:from typing import Optional, TYPE_CHECKING, Sequence..from electrum.util import UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore..from ..hw_wallet import HW_PluginBase.from ..hw_wallet.plugin import is_any_tx_output_on_change_branch, trezor_validate_op_return_output_and_get_data..if TYPE_CHECKING:. from .client import SafeTClient. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard..# Safe-T mini initialization methods.TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY = range(0, 4)...class SafeTKeyStore(Hardware_KeyStore):. hw_type = 'safe_t'. device = 'Safe-T mini'.. plugin: 'SafeTPlugin'.. def decrypt_message(self, sequence, message, password):.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\safe_t\transport.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):3566
                                        Entropy (8bit):4.057092640627583
                                        Encrypted:false
                                        SSDEEP:48:AQ2A08bYgHtJsEQFqHmEKdj1mcCFseqH0K01MCJz2w2H6z0r:9/ZbHYpqHjKR1TCFseqH0K01MCkJ20r
                                        MD5:8D74F45856984B897234324DDDDA24B1
                                        SHA1:99E08A642EEB29C436915AE0D2D1CA3B54FC45E8
                                        SHA-256:11805CAB34CFA8D9E5649660F8EDA874DA3B838D9A798FFF73AF36A99B6C5942
                                        SHA-512:5896102EE4CF79061E9F5FEEA99AF9CABB572ED43CC99D961D1FA16B085E551AF2CD61062C316605A9777032CB7961B42C61BC35B8F515BC880594DB86939441
                                        Malicious:false
                                        Preview:from electrum.logging import get_logger..._logger = get_logger(__name__)...class SafeTTransport:.. @staticmethod. def all_transports():. """Reimplemented safetlib.transport.all_transports so that we can. enable/disable specific transports.. """. # NOTE: the bridge and UDP transports are disabled as they are using. # the same ports as trezor. try:. # only to detect safetlib version. from safetlib.transport import all_transports. except ImportError:. # old safetlib. compat for safetlib < 0.9.2. transports = []. #try:. # from safetlib.transport_bridge import BridgeTransport. # transports.append(BridgeTransport). #except BaseException:. # pass. try:. from safetlib.transport_hid import HidTransport. transports.append(HidTransport). except BaseException:. pass.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\swapserver\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):281
                                        Entropy (8bit):4.673123753641383
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rh7ZFI3asnkDeh1Ebt+W/ir0aOvUTiVrmin:1YvQJ10aTDei+GxafOVDn
                                        MD5:8B3821DB8DBE1616231CD84E32E673C0
                                        SHA1:9813ED26316C86D4CBE5BC63E59B86CF43DDA484
                                        SHA-256:8D618898B3BD6026EA29F834AFE110C51CABF0AA33ADE67B100BC1C10035FF10
                                        SHA-512:678E5EB82260EAFE9F999A64C10FC52F1D7278B7D971652CCD0A88A48E41BBF5EEEB32AD3B3F14CE556027550F3C1E3890C6A43263BA18B12AEBBBD09B923CB2
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('SwapServer').description = """.Submarine swap server for an Electrum daemon...Example setup:.. electrum -o setconfig use_swapserver True. electrum -o setconfig swapserver_port 5455. electrum daemon -v.."""..available_for = ['cmdline'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\swapserver\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1256
                                        Entropy (8bit):5.155823600669133
                                        Encrypted:false
                                        SSDEEP:24:Uo29k4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFhiV:Ul9tJdVlPvLTmawQHlsyHIO5d3D1Fq
                                        MD5:6EC9B7A969DA6EB7CEA614180200F666
                                        SHA1:41EC25724D7BD518FB93773A334D819A0758B8C3
                                        SHA-256:38316F0A117F3FD4E6BC00F1FE17A409A2CC3CBABDD729EBDA07A979E907FBED
                                        SHA-512:657D6A40C968228B3A73D318E6DF99AF41F2E7E42A8E0B93103EC54097A543549EBDC14699FF62A51273678301AEBEB4644947063B4973415E26720DFEB06B13
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2023 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\swapserver\server.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):5604
                                        Entropy (8bit):4.247659402001842
                                        Encrypted:false
                                        SSDEEP:96:gtk7UOhk7dkqudkq+gdkqaKhQ3R81jn7Wn7CyiSCyFOFRL7sKjobNIONKtAAb:OOK7m3m6mghXfsCyiSCyFAZ1b
                                        MD5:F712135399E696A75ACDEE2DFC669878
                                        SHA1:94A94A5AFEBF491F29736439136941AFBAE49E5C
                                        SHA-256:FB9E1A4DAD21967653FFFC3AB1D79691ACCC5BED52F11CF2F2973373C29EDF4F
                                        SHA-512:551089C8229B5C898E9417291AC314B8F1066431B0B0BB5980B0B487D7569DB83635376B9E88C6A5B02382BA53DBD363077C162A4C763032C340BAE63219A648
                                        Malicious:false
                                        Preview:import os.import asyncio.from collections import defaultdict.from typing import TYPE_CHECKING..from aiohttp import web..from electrum.util import log_exceptions, ignore_exceptions.from electrum.logging import Logger.from electrum.util import EventListener.from electrum.lnaddr import lndecode..if TYPE_CHECKING:. from electrum.simple_config import SimpleConfig. from electrum.wallet import Abstract_Wallet...class SwapServer(Logger, EventListener):. """. public API:. - getpairs. - createswap. """.. WWW_DIR = os.path.join(os.path.dirname(__file__), 'www').. def __init__(self, config: 'SimpleConfig', wallet: 'Abstract_Wallet'):. Logger.__init__(self). self.config = config. self.wallet = wallet. self.sm = self.wallet.lnworker.swap_manager. self.port = self.config.SWAPSERVER_PORT. self.register_callbacks() # eventlistener.. self.pending = defaultdict(asyncio.Event). self.pending_msg = {}.. @ignore_exceptions.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\swapserver\swapserver.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):2173
                                        Entropy (8bit):5.070264365552861
                                        Encrypted:false
                                        SSDEEP:48:Ul9tJdVlPvLTmawQHlsyHIO5d3D1Fj++G4O83VyK:SzPjdwQHzJDS+G4l
                                        MD5:66DDC612C6AC03F03BF12047B2C01AEE
                                        SHA1:56F557E5F66F0ED5E3B697DABF3D5F550FA9E807
                                        SHA-256:7F9C7EC1D215BB53BF2654550FF7445F22854B6AAF95562C23112B2B92469BD9
                                        SHA-512:69D50ADCEC08B1B9A26793E910E174B08BA30C4304705F1B1BF88409E3E26670F4CD6D9EA1F76FC13BEE3D59F6A7E6348E22C65C6A91D6BC258BC5683F07B612
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2023 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trezor\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):272
                                        Entropy (8bit):4.786008146303495
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhyQfgv6IF3KaOIBZf+LMpQwKNQo6Kw6g+WGVrIeCM7iv:1YvQJyKe66OIBZ1ph2wfGV0dM+v
                                        MD5:E058B599B9BB73EDF3E28A02C437BE26
                                        SHA1:831B4631971268A66B515A093B67D2D1AB84A01D
                                        SHA-256:FD72B5833DC8DBCB9B96B5432AE494FBDB296604CBAF72D0F4B86B926C61259D
                                        SHA-512:C6E2752963378AEB885F252DE9D1744769484EFCE08666B931ACEF5ECBEFA12A67BB2BCBFD0A58FC2725AF186E99C0A9A25E7C79A2045AF12E376263A5D82F00
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Trezor Wallet'.description = _('Provides support for Trezor hardware wallet').requires = [('trezorlib','pypi.org/project/trezor/')].registers_keystore = ('hardware', 'trezor', _("Trezor wallet")).available_for = ['qt', 'cmdline']..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trezor\clientbase.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):12888
                                        Entropy (8bit):4.509681343167102
                                        Encrypted:false
                                        SSDEEP:192:sEKDuv6c1tyNQ8doIh8lI0KpNpeCaO9Z51mNl05BZWhz:xv6c1tyNBdo7dKrpepuZ51wAWhz
                                        MD5:DAA68E004400994AAA6965D32DBA53FE
                                        SHA1:78D133C1D8D32B0F917D3991F3F9E9F7FC606278
                                        SHA-256:84A6A5D716724C320B0D1ED08AD1A767B452533D1D7E66FFFA336585DAA506E1
                                        SHA-512:E0C75CAE960673C3939C0887AF8837EA0649A35E274200FF3E3820A19DC900D39A763BF5F2E79EF80BA8C8A3054FE855DC887CD91037C459D2B91904D8A91D23
                                        Malicious:false
                                        Preview:import time.from struct import pack..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled, UserFacingException.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath as parse_path.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import OutdatedHwFirmwareException, HardwareClientBase..from trezorlib.client import TrezorClient, PASSPHRASE_ON_DEVICE.from trezorlib.exceptions import TrezorFailure, Cancelled, OutdatedFirmwareError.from trezorlib.messages import WordRequestType, FailureType, RecoveryDeviceType, ButtonRequestType.import trezorlib.btc.import trezorlib.device..MESSAGES = {. ButtonRequestType.ConfirmOutput:. _("Confirm the transaction output on your {} device"),. ButtonRequestType.ResetDevice:. _("Complete the initialization process on your {} device"),. ButtonRequestType.C

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trezor\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):909
                                        Entropy (8bit):4.652809271805978
                                        Encrypted:false
                                        SSDEEP:24:1/emAOAtpVBA8nEBcfP466hHvsb/aC9sahfA0y/:demAFdr01vwaCVZG
                                        MD5:5E0A672C8DF5259377040713B13891AB
                                        SHA1:6032B7262AC9DF8A3FAC7773B9D4A469A6169D14
                                        SHA-256:E411C2605E91F0490C74CCBA9CDE8E5A9F798B8561F0F7D55CCD8DAC610AF8A2
                                        SHA-512:5A9D028D60134415BDC97E27DEF8D4C570B8BC1DF1845552692FCA596F41FDC1400F488EB2C6BC969EE6316BA6057D303B001A92D30087BDDA24D91075BDBD91
                                        Malicious:false
                                        Preview:from electrum.plugin import hook.from electrum.i18n import _.from electrum.util import print_stderr.from .trezor import TrezorPlugin, PASSPHRASE_ON_DEVICE.from ..hw_wallet import CmdLineHandler..class TrezorCmdLineHandler(CmdLineHandler):. def __init__(self):. self.passphrase_on_device = False. super().__init__().. def get_passphrase(self, msg, confirm):. import getpass. print_stderr(msg). if self.passphrase_on_device and self.yes_no_question(_('Enter passphrase on device?')):. return PASSPHRASE_ON_DEVICE. else:. return getpass.getpass('')..class Plugin(TrezorPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trezor\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):37455
                                        Entropy (8bit):4.635419853213909
                                        Encrypted:false
                                        SSDEEP:768:3GRkbbfsyTrV2lvVSjlmmvi4yL6OaoJa4z1jz:o6bkyTrV2l9SjlmSi4yL6Oaka4z13
                                        MD5:B228481C96665FD645EC7A2F79250880
                                        SHA1:CD44B61E9766D041AEEC671ED05B88BA328B3BC6
                                        SHA-256:EDD0ACEABC10CC40BEC9EA22C6F9CFF1F23259F5D6D6E7A8F10BD835FA6EC119
                                        SHA-512:25A2F35ABEF59AD0674984B67F9172B4709CC1F4355218738D3C912EC2F19CD0033431B369AD61FE31767D3AD757C8B427DF3B938889304E2966F55B109940A6
                                        Malicious:false
                                        Preview:from functools import partial.import threading.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QEventLoop, pyqtSignal.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox, QDialog,. QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QSlider, QTabWidget)..from electrum.i18n import _.from electrum.logging import Logger.from electrum.plugin import hook.from electrum.keystore import ScriptTypeNotSupported..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet.plugin import only_hook_if_libraries_available, OutdatedHwFirmwareException..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, PasswordLineEdit, getOpenFileName, ChoiceWidget).from electrum.gui.qt.wizard.wallet import WCScriptAndDer

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trezor\trezor.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):22315
                                        Entropy (8bit):4.493298888774816
                                        Encrypted:false
                                        SSDEEP:384:2OWNZzZPTmr861/+j6p8qqZ+d1wSWInNyP:2O+d7mrRx+Op8eGINg
                                        MD5:E2F74B1D941CA0077079B86A95674CBD
                                        SHA1:3A8F0D9A9083188928BDBEDBF95F562DDBD018A5
                                        SHA-256:52AEFB59DA8D95A7A8D79BF5BC458888B4168847AD7076B8CA571CDD63D56EAE
                                        SHA-512:AC2C6FE9A994655406B825C7E5B8A60C1A6133981C3E8681D3358985ED06BC21C90E99C7C5681D921E87C9E1EE5A4E336E0664C216983E9ECE80B3C52D58AF89
                                        Malicious:false
                                        Preview:from typing import NamedTuple, Any, Optional, TYPE_CHECKING, Sequence..from electrum.util import bfh, UserCancelled, UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore.from electrum.logging import get_logger..from electrum.plugins.hw_wallet import HW_PluginBase.from electrum.plugins.hw_wallet.plugin import is_any_tx_output_on_change_branch, \. trezor_validate_op_return_output_and_get_data, LibraryFoundButUnusable, OutdatedHwFirmwareException..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. import trezorlib. import trezorlib.transport. from trezorlib.transport.bridge import BridgeTransport,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):427
                                        Entropy (8bit):4.980850437894484
                                        Encrypted:false
                                        SSDEEP:12:1YvQJjvMLuk9v+HWTqgKYtKYVnACw/V0dM+:1YIj0Rv+H6qgKAKkw/p+
                                        MD5:E66C24ACF8F44F23398D7FDFFFE3649C
                                        SHA1:0881088EEC342763265462BDC9CA2814C49F49ED
                                        SHA-256:AD34B9362ABE25CB8D30FFF4381557BF26F714011306A3B6A7A9CAA991024DAF
                                        SHA-512:A3BA8BF68BB218A4BD5D557DD57F483E737337CF244BBE8D655F0580DCC67E13E20C6C5C67C84C1010DD06EA4D9FB673477A699243B8D64B57DC1A81365D9831
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = _('Two Factor Authentication').description = ''.join([. _("This plugin adds two-factor authentication to your wallet."), '<br/>',. _("For more information, visit"),. " <a href=\"https://api.trustedcoin.com/#/electrum-help\">https://api.trustedcoin.com/#/electrum-help</a>".]).requires_wallet_type = ['2fa'].registers_wallet_type = '2fa'.available_for = ['qt', 'cmdline', 'qml'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\cmdline.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1894
                                        Entropy (8bit):5.069934641699078
                                        Encrypted:false
                                        SSDEEP:48:UMotJdVlPvLTmawQHlsyHIO5d3D1FLmoJOaCDkfaIiznYiNa0i3S:czPjdwQHzJDTmANSjznTQXi
                                        MD5:3CC359BD71D0D159C1F9B786FAF0A059
                                        SHA1:7A90F59E2BB4BF9EA234F04EA9338F0178087058
                                        SHA-256:D569F1D5F6003ADA5CEFB7B32F0B319DF18F66018DC9058F43C28E0005BDC585
                                        SHA-512:556EC5B104C8EF1D61F065DA9DC57077172F9720C78133688913A4CAC0F5DF1FF3355282103D914C31B1B111F5CADA9B1D3FBE5AF94FDE04C647C7B3B945E8C3
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\common_qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):9525
                                        Entropy (8bit):4.463728912000741
                                        Encrypted:false
                                        SSDEEP:192:tALDsa+8Q9ClNoMQhhnNiDliJvBfCfMCsvqCQoC2TCsUCrICgcCdC+BniCsvfCsK:tZKQTRvEfDsv5Qf2Osbr/gzAqhsvqsgZ
                                        MD5:94C7B1918CF6851A6088A9C1D4953A55
                                        SHA1:086F14E5E860DCE219C26B5E8B938EDCF022E7D9
                                        SHA-256:3D6F3BF6DFCAB65DB6AAD597C405FF4A5D6AA5B2A4608F810959A01ED976636C
                                        SHA-512:ABA2EE8E8E6D5AF5655EC4139E669EDF0C2EC30901B14F2D3769B8D2456BF3B9D2D53C89F39B6838DC0BBBCC46D5817F50C2D22900B3FC5D2396E029A3CD9188
                                        Malicious:false
                                        Preview:import threading.import socket.import base64.import sys.from typing import TYPE_CHECKING..from electrum.gui.common_qt import get_qt_major_version..if (qt_ver := get_qt_major_version()) == 5:. from PyQt5.QtCore import pyqtSignal, pyqtProperty, pyqtSlot.elif qt_ver == 6:. from PyQt6.QtCore import pyqtSignal, pyqtProperty, pyqtSlot.else:. raise Exception(f"unexpected {qt_ver=}")..from electrum.i18n import _.from electrum.bip32 import BIP32Node..from .trustedcoin import (server, ErrorConnectingServer, MOBILE_DISCLAIMER, TrustedCoinException).from electrum.gui.common_qt.plugins import PluginQObject..if TYPE_CHECKING:. from electrum.wizard import NewWalletWizard...class TrustedcoinPluginQObject(PluginQObject):. canSignWithoutServerChanged = pyqtSignal(). termsAndConditionsRetrieved = pyqtSignal([str], arguments=['message']). termsAndConditionsError = pyqtSignal([str], arguments=['message']). otpError = pyqtSignal([str], arguments=['message']). otpSuccess = pyqtSign

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qml.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):4438
                                        Entropy (8bit):4.542663800780709
                                        Encrypted:false
                                        SSDEEP:96:FmaHbRSMlYf6iEojAToJ1CaQSreVa6rIye8Rbirb0EVk5qw:FQMqf6zodfRyk3+
                                        MD5:71B16A8DAA21E4160EB6652E16777949
                                        SHA1:CBA87F51104DED30AADB589CDA8DEB51A673E568
                                        SHA-256:B8D20D0B69EAE96C4FF3657A3C08BA24DE4D708EF232617631BAE1D0A71E818D
                                        SHA-512:E9EF841CA716C50D0FA42FE3214ABC0E157849CF06DCB57B96439FBD0BA15E0E95BDB317AF0EF5D4544C19808A02AD179189E723D1B294287CD8377E6B9CDFDD
                                        Malicious:false
                                        Preview:from typing import TYPE_CHECKING..from electrum.i18n import _.from electrum.plugin import hook.from electrum.util import UserFacingException..from electrum.gui.qml.qewallet import QEWallet.from .common_qt import TrustedcoinPluginQObject..from .trustedcoin import TrustedCoinPlugin, TrustedCoinException..if TYPE_CHECKING:. from electrum.gui.qml import ElectrumQmlApplication. from electrum.wallet import Abstract_Wallet. from electrum.wizard import NewWalletWizard...class Plugin(TrustedCoinPlugin):. def __init__(self, *args):. super().__init__(*args).. @hook. def load_wallet(self, wallet: 'Abstract_Wallet'):. if not isinstance(wallet, self.wallet_class):. return. self.logger.debug(f'plugin enabled for wallet "{str(wallet)}"'). if wallet.can_sign_without_server():. self.so._canSignWithoutServer = True. self.so.canSignWithoutServerChanged.emit().. msg = ' '.join([. _('This wallet was rest

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qml\ChooseSeed.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):987
                                        Entropy (8bit):4.377160104670154
                                        Encrypted:false
                                        SSDEEP:24:I60KU0cWm7HWgAsDXQHsXAEWBsUNf0yTEWBsUG4b:I60KU3W385wEyT5b
                                        MD5:1538526A6F8C2B5BBCF41D29176E0033
                                        SHA1:5BF872444F9AC66B60F78010211E73260D4C7AAB
                                        SHA-256:CAC28FA0E5AB8E92C0D39EE6347A483BF0CC729CC7F4128FF3A9B9E7787A57A0
                                        SHA-512:52EB06472FF6D64A2F9434EBDB3A6F531C0B79EE22F06DA1B2F35D461092B0DD9FE95977FC8A9440CB0867969CF5E603DBE2AE7EFE4DCCA731942661935EF304
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: keystoregroup.checkedButton !== null.. onAccept: {. wizard_data['keystore_type'] = keystoregroup.checkedButton.keystoretype. }.. ButtonGroup {. id: keystoregroup. }.. ColumnLayout {. width: parent.width. Label {. text: qsTr('Do you want to create a new seed, or restore a wallet using an existing seed?'). Layout.preferredWidth: parent.width. wrapMode: Text.Wrap. }. RadioButton {. ButtonGroup.group: keystoregroup. property string keystoretype: 'createseed'. checked: true. text: qsTr('Create a new seed'). }. RadioButton {. ButtonGroup.group: keystoregroup. property string keystoretype: 'haveseed'. text: qsTr('I already have a seed'). }. }.}..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qml\Disclaimer.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):691
                                        Entropy (8bit):4.488786222118965
                                        Encrypted:false
                                        SSDEEP:12:IZ3g0KUVwtQdcRIBgoNn8XvWqEZdbUNAkQfavJWpMZewBC3:I60KUOQdcWm9XOqEHbUNAkOUk
                                        MD5:7BBE01289D5EF8E1BFD0A228791F9F4A
                                        SHA1:16B766B60574DDCC8F240911221833D580850DC4
                                        SHA-256:8BFE67D032D999F0A189A2D40D263D4805752DD19D802520CB593C2103492B0F
                                        SHA-512:6F53E111053BA0B8FE43B9B6776C57F1D9D30388A496404214B69FCE6FE556F66FA35C7F6FF9453E3E0862C64525A0CE2B1E971DE90370C90AE86F2C285664BE
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import org.electrum 1.0..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: true.. property QtObject plugin.. ColumnLayout {. width: parent.width.. Image {. Layout.alignment: Qt.AlignHCenter. Layout.bottomMargin: constants.paddingLarge. source: '../../../gui/icons/trustedcoin-wizard.png'. }.. Label {. Layout.fillWidth: true. text: plugin ? plugin.disclaimer : ''. wrapMode: Text.Wrap. }. }.. Component.onCompleted: {. plugin = AppController.plugin('trustedcoin'). }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qml\KeepDisable.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):869
                                        Entropy (8bit):4.480847222564419
                                        Encrypted:false
                                        SSDEEP:12:IZ3g0KU0cRIBgPnvMfsZEgAUoXjWd/qEWQleUcZ708pD8EWQleUcwKmkL:I60KU0cWm8BgAxUCEWBT70bEWBLL
                                        MD5:4985A1EF1BE8632AC940FE9870EE1B8C
                                        SHA1:124107285D54EFD05F52C3FF8218887EA9782B79
                                        SHA-256:D7EBDE437B8C5C7248F976F52DC7B3623BD37E8A8B0EEBF8DAA77FB519E29301
                                        SHA-512:F313573375CE56022E6435D77EE84F3B15CCB39BD9DC0EF2C11CA049748F914E97686FED8E30C6093151E2767943B4960015A5F44B338D0EB478DA3338103570
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: keepordisablegroup.checkedButton.. function apply() {. wizard_data['trustedcoin_keepordisable'] = keepordisablegroup.checkedButton.keepordisable. }.. ButtonGroup {. id: keepordisablegroup. onCheckedButtonChanged: checkIsLast(). }.. ColumnLayout {. Label {. text: qsTr('Restore 2FA wallet'). }. RadioButton {. ButtonGroup.group: keepordisablegroup. property string keepordisable: 'keep'. checked: true. text: qsTr('Keep'). }. RadioButton {. ButtonGroup.group: keepordisablegroup. property string keepordisable: 'disable'. text: qsTr('Disable'). }. }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qml\ShowConfirmOTP.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):4228
                                        Entropy (8bit):4.394171154362271
                                        Encrypted:false
                                        SSDEEP:96:L0S5y4rPp1r+0Tb5r+heUrZ80v4KmLUYCU8SaoP9QHX3DsDCdcNsb:IS5LPpV+0Ttr+heUrZ80gKmgYCU8RhHb
                                        MD5:9579E86B3DBAAFDB82E23ACDDECDCFEB
                                        SHA1:F0DC65BB4D4AACDEFF7287CE786213D3BAB612F6
                                        SHA-256:8076B6213C037DE30FD588095416310CB3FE996CB59D0EEBF4F32902E8C93ED4
                                        SHA-512:2C594258B345033710776F3CA00A621895E82A274E09A92A56D587D8458A89E84A68FFDD8BA8084429FFA95CF424E1BDFF892910716B0D9922899FBC50EB9CB8
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard".import "../../../gui/qml/components/controls"..WizardComponent {. valid: otpVerified.. property QtObject plugin.. property bool otpVerified: false.. ColumnLayout {. width: parent.width.. Label {. text: qsTr('Authenticator secret'). }.. InfoTextArea {. id: errorBox. Layout.fillWidth: true. iconStyle: InfoTextArea.IconStyle.Error. visible: !otpVerified && plugin.remoteKeyState == 'error'. }.. InfoTextArea {. Layout.fillWidth: true. iconStyle: InfoTextArea.IconStyle.Warn. visible: plugin.remoteKeyState == 'wallet_known'. text: qsTr('This wallet is already registered with TrustedCoin. '). + qsTr('To finalize wallet creation, please enter your Google Authenticator Code. '). }.. QRImage {.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qml\Terms.qml

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):1664
                                        Entropy (8bit):4.147635049972669
                                        Encrypted:false
                                        SSDEEP:24:I60KUOQdcWmcQ2HG5C+tEBAETFrXVAgXENHtP1eyUxGZSzAzCSAT8FCcCSiXL:I60KUOFWNpHBL3Ag0hBoyXyICjXL
                                        MD5:07F02079D50F78DA217FD0AE27EDE2C1
                                        SHA1:3007E9769D5C3F2CABAF9982A4702938B1EA7175
                                        SHA-256:4F7AD2042911BE29B1341B69BFCF9B96F3A07365ED411442343A8CC52E997FC3
                                        SHA-512:5BEDDBD8C6EBC17B12D6A57C9D9DB0FA5B873EFB51AFCBB7FCEB9CA02DDE0FBFC0840BEAADABC1C5B9DB61426F35A9EED73B5B1B79133E828055573D67E0EEB7
                                        Malicious:false
                                        Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import org.electrum 1.0..import "../../../gui/qml/components/wizard".import "../../../gui/qml/components/controls"..WizardComponent {. valid: !plugin ? false. : tosShown.. property QtObject plugin. property bool tosShown: false.. ColumnLayout {. anchors.fill: parent.. Label {. text: qsTr('Terms and conditions'). }.. TextHighlightPane {. Layout.fillWidth: true. Layout.fillHeight: true. rightPadding: 0.. Flickable {. anchors.fill: parent. contentHeight: termsText.height. clip: true. boundsBehavior: Flickable.StopAtBounds.. Label {. id: termsText. width: parent.width. rightPadding: constants.paddingSmall. wrapMode: Text.Wrap. }.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):24562
                                        Entropy (8bit):4.701707850115183
                                        Encrypted:false
                                        SSDEEP:384:Ro6St2QXexCeNDjm8A0pNtF/UqtaOugBbIXXFoqLLfvfsqNkjdNRHl:26StdteZjmv8NtF8qtaBJ7njNKp
                                        MD5:D189A164CF2BB14FC3699A43F7F67BD8
                                        SHA1:1D43F0A4033659E56B8757E95F6D95F0B59228DB
                                        SHA-256:0E0E5DD229A4B8FBE56B963DEBD0C4AEA09B7689E3BF64431D6302B7024711C5
                                        SHA-512:2682EA96CFE62DD511CE4667D0CEA5F25DA5BFC551D2CC645914ED86B42281010D768C1F92D152504B78123C1F8E9D1371859A814D008788FE82FE253335DAB8
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\trustedcoin\trustedcoin.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):27622
                                        Entropy (8bit):4.672349210966519
                                        Encrypted:false
                                        SSDEEP:192:cdwQHdx9KlVQIxD2B0wp+dIJ1ich38ppDdMhvlhpMWqhud+RTL58bX0HGTsK1A0L:RoixxSDofZTL5MhsFb355lfbOMcV
                                        MD5:C7012BDAF5468CAECF1D755E76591489
                                        SHA1:AF6124794CED1CE440519A6A3515853BBE1633A5
                                        SHA-256:F147B9073BFE678A99861B7624084423EE3A8426A84EAF951BAF83A4C9BCDCE4
                                        SHA-512:4154DFB6BE1B4DF712DA565ACE2455151C13C863B8D3921A05C406E594C5442E2E65F89C50F49285859D940FE59161D0FBA06CFA04F2423A40633E848BAB0AFB
                                        Malicious:false
                                        Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\virtualkeyboard\__init__.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):242
                                        Entropy (8bit):4.814099320310534
                                        Encrypted:false
                                        SSDEEP:6:1YvQ7rhwQPVnda5u14Afv8gj5XtzTLZYvuTgXlWGVrIr:1YvQJlu5u2AfJtpLauucGV0r
                                        MD5:C2FC53DA569BBAEE6CBCB27F3746CE0B
                                        SHA1:0B7C01AFBC0EA31165FF39320E07000E573D1B93
                                        SHA-256:5EF1742F961BC7CBF3961A0E06CCFC58187D5D41F385309A73153C3524B7A273
                                        SHA-512:1C27B5476B1DF445609200B89711D5D0E3F524B11B1E146FB693B3B05B9446F019FA768C06348CFB11278DB18F80B791539AB9EFC1148361CD524BD9C545B3B1
                                        Malicious:false
                                        Preview:from electrum.i18n import _..fullname = 'Virtual Keyboard'.description = '%s\n%s' % (_("Add an optional virtual keyboard to the password dialog."), _("Warning: do not use this if it makes you pick a weaker password.")).available_for = ['qt'].

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\plugins\virtualkeyboard\qt.py

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Python script, ASCII text executable
                                        Category:dropped
                                        Size (bytes):1989
                                        Entropy (8bit):4.69457366463934
                                        Encrypted:false
                                        SSDEEP:48:Q6ReyWw9TzjWZEWKX1uT0/aHm96OHPSJds:b0yWUiq/2Ta6Pds
                                        MD5:48FBF4FD09D00CEBF3C2970F7F803476
                                        SHA1:5AD56DC851A74A39EF3082988060DDEBA7FCE10C
                                        SHA-256:0937910B1C26B9240D39C6FFB5A424AD7C9FE3C3B807147AD3F4B84ED62809D2
                                        SHA-512:A371C5ECA125DFC85BD367C0F7B89F7AC98E3ED6B8AAA2E4DBDAFACF92E47BF6311DD8FF5DA56D970AA58868D0386F87E10954238251ED6C5A3158AC6B605411
                                        Malicious:false
                                        Preview:import random..from PyQt5.QtWidgets import (QVBoxLayout, QGridLayout, QPushButton).from PyQt5.QtGui import QFontMetrics..from electrum.plugin import BasePlugin, hook.from electrum.i18n import _...class Plugin(BasePlugin):. vkb = None. vkb_index = 0.. @hook. def password_dialog(self, pw, grid, pos):. vkb_button = QPushButton("+"). font_height = QFontMetrics(vkb_button.font()).height(). vkb_button.setFixedWidth(round(1.7 * font_height)). vkb_button.clicked.connect(lambda: self.toggle_vkb(grid, pw)). grid.addWidget(vkb_button, pos, 2). self.kb_pos = 2. self.vkb = None.. def toggle_vkb(self, grid, pw):. if self.vkb:. grid.removeItem(self.vkb). self.vkb = self.virtual_keyboard(self.vkb_index, pw). grid.addLayout(self.vkb, self.kb_pos, 0, 1, 3). self.vkb_index += 1.. def virtual_keyboard(self, i, pw):. i = i % 3. if i == 0:. chars = 'abcdefghijklmnopqrstuvwxyz '.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\servers.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):10498
                                        Entropy (8bit):4.0827969081007405
                                        Encrypted:false
                                        SSDEEP:192:w/AJ9+NTen0vi0KIYxPkv5gAb1q4h6t/FA06FLWZoOW6BrxFie3UG0jpr6MdRgGd:cBCcP/V
                                        MD5:FCBF1CC8CF6A61B5729A1A78293C5D66
                                        SHA1:56F37B925043391EB8987FBFC3614FBD6C53C51F
                                        SHA-256:5B320E11B6AF674AB93C7FD2D89EA303A3A60634C4FBE3C8FB058DD4EF6BEAD3
                                        SHA-512:B7D5C1A1AA55B3BC537EDA3CF610F969D4EF3883127A911888E2A5BA201D51D53B0FB783B588A97A2EC3ED73F353C3AAFBF99478FCCFC3666DCDCA42FC0C35C5
                                        Malicious:false
                                        Preview:{. "104.248.139.211": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "128.0.190.26": {. "pruning": "-",. "s": "50002",. "version": "1.4.2". },. "142.93.6.38": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "157.245.172.236": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "159.65.53.177": {. "pruning": "-",. "t": "50001",. "version": "1.4.2". },. "167.172.42.31": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "188.230.155.0": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "22mgr2fndslabzvx4sj7ialugn2jv3cfqjb3dnj67a6vnrkp7g4l37ad.onion": {. "pruning": "-",. "t": "50001",. "version": "1.4.2". },. "2AZZARITA

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\servers_regtest.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):122
                                        Entropy (8bit):3.4854012322496546
                                        Encrypted:false
                                        SSDEEP:3:34QWFnXe5topFFF8HRF7HkBXF52S1kvNiAvn:3sA56+HIqS1kwAv
                                        MD5:FAE0E5714B66267E656500A0766784AC
                                        SHA1:B5078FE5B0F6B5E81C759A322684D74AF3B72F95
                                        SHA-256:5018BE2D11F596DF37E19F9AD0581D66C22C6D1F50B2BA1F4AFBFA32DED922A7
                                        SHA-512:9832E3C6EC7609481F36573EA987972B80B41F64CA650B14D5AB9BC1173708F354BEC8A5DAFD65CF8323BA0B79B37DBF4F1E952FA8B4D89369BE2D20E7966B2C
                                        Malicious:false
                                        Preview:{. "127.0.0.1": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4". }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\servers_signet.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):366
                                        Entropy (8bit):3.8609658916403737
                                        Encrypted:false
                                        SSDEEP:6:3sA56+HIqS1kwL0OAGu8A56+uuUcS1kwLiOq0cfFwA56+V8S1kwAv:L6z1kwq16r/1kw2f0ctn6Qf1kwK
                                        MD5:27CC53FE12321059F03077930CD08D4B
                                        SHA1:56BBF7DA37D7EC3BFA30144746C47A5571790897
                                        SHA-256:0502A5A5C6ECC5BB89B6FD4987031BA72B94843E7149A226D3A7AD197117B230
                                        SHA-512:E92BCFCBC028F8960E5086042096DCD8B39B7E30412DF2016909C323199C292118A407ED84291C3DC6240938EAB861E1DEFEC84341ED932BE1E03F60718526E7
                                        Malicious:false
                                        Preview:{. "127.0.0.1": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4". },. "signet-electrumx.wakiyamap.dev": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4". },. "electrum.emzy.de": {. "pruning": "-",. "s": "53002",. "version": "1.4". }.}.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\servers_testnet.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1031
                                        Entropy (8bit):4.021117622225254
                                        Encrypted:false
                                        SSDEEP:24:4J40d1oQQf8I1P2v8A1P2I2YY1PrZQ1oA9xe1oAjQ18WP1K1PK:4J40nop8w+UI+CA1YoYCoyYnP1mS
                                        MD5:7EDE5F010661C804BC862C078E4514C0
                                        SHA1:48A7B56E2CAFF7C35C37541417E568E04C9130C6
                                        SHA-256:CD6BD116AF89B8DE77AD0A1A68A91672F0A219E39061A9CE324685D7652D4EA7
                                        SHA-512:0BF5283C0E713BCA7D58E5CDE4CC5B03F276F5C4D12862EB806EAB2B2E3C88FD8DD6CC6F64AEFAE06601927A24D5393EDF6A2AE237E6EC47FD5407EA8A9B62C4
                                        Malicious:false
                                        Preview:{. "blackie.c3-soft.com": {. "pruning": "-",. "s": "57006",. "t": "57005",. "version": "1.4.5". },. "blockstream.info": {. "pruning": "-",. "s": "993",. "t": "143",. "version": "1.4". },. "electrum.blockstream.info": {. "pruning": "-",. "s": "60002",. "t": "60001",. "version": "1.4". },. "explorerzydxu5ecjrkwceayqybizmpjjznk5izmitf2modhcusuqlid.onion": {. "pruning": "-",. "t": "143",. "version": "1.4". },. "testnet.aranguren.org": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4.2". },. "testnet.hsmiths.com": {. "pruning": "-",. "s": "53012",. "version": "1.4.2". },. "testnet.qtornado.com": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.5". },. "tn.not.fyi": {. "pruning": "-",. "s": "55002",. "t": "55001",.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\wordlist\english.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):13116
                                        Entropy (8bit):4.2192956006819475
                                        Encrypted:false
                                        SSDEEP:192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
                                        MD5:F23506956964FA69C98FA3FB5C8823B5
                                        SHA1:B2D5241AE027A0E40F06A33D909809A190F210FE
                                        SHA-256:2F5EED53A4727B4BF8880D8F3F199EFC90E58503646D9FF8EFF3A2ED3B24DBDA
                                        SHA-512:416C71BA30018EA292BB36CDC23C9329673485A8D8933266A9D9A7CC72153B8BAED3D430F52EAB4F5D3ADDF6583611B3777A50454599F1E42716F5F879621123
                                        Malicious:false
                                        Preview:abandon.ability.able.about.above.absent.absorb.abstract.absurd.abuse.access.accident.account.accuse.achieve.acid.acoustic.acquire.across.act.action.actor.actress.actual.adapt.add.addict.address.adjust.admit.adult.advance.advice.aerobic.affair.afford.afraid.again.age.agent.agree.ahead.aim.air.airport.aisle.alarm.album.alcohol.alert.alien.all.alley.allow.almost.alone.alpha.already.also.alter.always.amateur.amazing.among.amount.amused.analyst.anchor.ancient.anger.angle.angry.animal.ankle.announce.annual.another.answer.antenna.antique.anxiety.any.apart.apology.appear.apple.approve.april.arch.arctic.area.arena.argue.arm.armed.armor.army.around.arrange.arrest.arrive.arrow.art.artefact.artist.artwork.ask.aspect.assault.asset.assist.assume.asthma.athlete.atom.attack.attend.attitude.attract.auction.audit.august.aunt.author.auto.autumn.average.avocado.avoid.awake.aware.away.awesome.awful.awkward.axis.baby.bachelor.bacon.badge.bag.balance.balcony.ball.bamboo.banana.banner.bar.barely.bargain.barre

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\electrum\wordlist\slip39.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:C source, ASCII text
                                        Category:dropped
                                        Size (bytes):7231
                                        Entropy (8bit):4.235985120108038
                                        Encrypted:false
                                        SSDEEP:192:go28rtOqlnqd1su9Jgubann5D1fN2J4kmeY3:A8saqDbbIn5DNoJ4kO
                                        MD5:BF2027501393E153341E01B46BDF4A3B
                                        SHA1:650C1DF1DA9BD5499DD951837B45EBBB738AF82A
                                        SHA-256:BCC4555340332D169718AED8BF31DD9D5248CB7DA6E5D355140EF4F1E601EEC3
                                        SHA-512:57F1A57BE2EDA50E923D6C3766612745E2B22F14C16B683376F120E1FBB4F15D1C3E58CEEA9D4B3D3871A7FFAE94A1AB7AFD2E69CBFD53CC55A9A1C87CC586F6
                                        Malicious:false
                                        Preview:academic.acid.acne.acquire.acrobat.activity.actress.adapt.adequate.adjust.admit.adorn.adult.advance.advocate.afraid.again.agency.agree.aide.aircraft.airline.airport.ajar.alarm.album.alcohol.alien.alive.alpha.already.alto.aluminum.always.amazing.ambition.amount.amuse.analysis.anatomy.ancestor.ancient.angel.angry.animal.answer.antenna.anxiety.apart.aquatic.arcade.arena.argue.armed.artist.artwork.aspect.auction.august.aunt.average.aviation.avoid.award.away.axis.axle.beam.beard.beaver.become.bedroom.behavior.being.believe.belong.benefit.best.beyond.bike.biology.birthday.bishop.black.blanket.blessing.blimp.blind.blue.body.bolt.boring.born.both.boundary.bracelet.branch.brave.breathe.briefing.broken.brother.browser.bucket.budget.building.bulb.bulge.bumpy.bundle.burden.burning.busy.buyer.cage.calcium.camera.campus.canyon.capacity.capital.capture.carbon.cards.careful.cargo.carpet.carve.category.cause.ceiling.center.ceramic.champion.change.charity.check.chemical.chest.chew.chubby.cinema.civil.cl

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\hid.cp310-win32.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):78336
                                        Entropy (8bit):6.396606725288797
                                        Encrypted:false
                                        SSDEEP:1536:sRqRTyvCslycXWmiWEV7xZaGlgEyz0e3pCG:GmOvLMYWmUV3VgEyz0
                                        MD5:084F1A8DB3FDF6520F6B63D7489B1971
                                        SHA1:6A4855600B7EE4D387296D3952B005BCF4770DD2
                                        SHA-256:59E478CB62FFEAF7B3EACB59B3BB94C3225E3307B2CB2370FAAB55C3B99E93C7
                                        SHA-512:097A91821B52ACE69203DF03588E9D419979B308A592B1359386818C61FAC930743D4875E883377F4B21ABF3B8DC5CD51C444395AD61EF424201398F96C57C2E
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>a..P2..P2..P2...2..P2..Q3..P2..Q3..P2..U3..P2..T3..P2..S3..P26.Q3..P2..Q2K.P2C.X3..P2C.P3..P2C.2..P2C.R3..P2Rich..P2................PE..L...R7sd...........!...".....p............................................................@............................. ............P.......................`......X...................................@............................................text............................... ..`.rdata...9.......:..................@..@.data.... ... ......................@....rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\libcrypto-1_1.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):2276120
                                        Entropy (8bit):6.111762453951637
                                        Encrypted:false
                                        SSDEEP:49152:3L7Iy5xntVyJSFtv3A8+QK1CPwDv3uFfJKShr:3L7Iy59nFdA8m1CPwDv3uFfJK+
                                        MD5:4633D62F19C0B25318B1C612995F5C21
                                        SHA1:50601F9E2B07D616FDE8EE387CE8CDCB0CA451DF
                                        SHA-256:47376D247AE6033BC30FEE4E52043D3762C1C0C177E3EC27CA46EFF4B95C69B0
                                        SHA-512:D6A18E43B1A20242F80265054ED8D33598439FFA5DF4920931FF43EC91F1AC2D8A3931913FD5569F48C9B1B9EA845D9E017EA23571A1AC1B352502A3E823ECA9
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..uk..uk..uk...k..uk..tj..uk..pj..uk..qj..uk..vj..uk..tko.uk..tj..uk2.qjs.uk2.uj..uk2..k..uk2.wj..ukRich..uk........PE..L......c...........!...".(...........g.......@................................#.....8."...@.........................`....h....!.T.....".|............."../....".4.......8...............................@.............!..............................text....&.......(.................. ..`.rdata..v*...@...,...,..............@..@.data...TY...p!......X!.............@....idata........!......n!.............@..@.00cfg........!.......!.............@..@.rsrc...|.....".......!.............@..@.reloc........".......!.............@..B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\libffi-7.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):29208
                                        Entropy (8bit):6.643623418348
                                        Encrypted:false
                                        SSDEEP:384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
                                        MD5:BC20614744EBF4C2B8ACD28D1FE54174
                                        SHA1:665C0ACC404E13A69800FAE94EFD69A41BDDA901
                                        SHA-256:0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
                                        SHA-512:0C473E7070C72D85AE098D208B8D128B50574ABEBBA874DDA2A7408AEA2AABC6C4B9018801416670AF91548C471B7DD5A709A7B17E3358B053C37433665D3F6B
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..qm.."m.."m.."d.p"o.."?..#o.."...#n.."m.."I.."?..#f.."?..#g.."?..#n.."...#k.."...#l.."...#l.."...#l.."Richm.."................PE..L.....]...........!.....@...........E.......P......................................H.....@.........................pU.......X..P....................X.......p..<....R..............................0R..@............P...............................text...j>.......@.................. ..`.rdata..p....P.......D..............@..@.data........`.......R..............@....reloc..<....p.......T..............@..B................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\libsecp256k1-2.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):1191950
                                        Entropy (8bit):7.95358118007957
                                        Encrypted:false
                                        SSDEEP:24576:FLc/LDeIWs9GsChyXuRtANMoQRELx/pYuhIe57Low7X4k:FGnWs0YGANMoywHhSC7LPB
                                        MD5:EA146BC906C10F8F8A6BD96E54174966
                                        SHA1:6962DF1C2AFF684F6BA568FDA055CE7905122421
                                        SHA-256:6C6326835F4794B368505EB553384F043CA1E21488EEA06147435B6F2A2CF737
                                        SHA-512:A9C5E5B5B371CD068126AF0E5CC59581244E81F26444CE5431CDD2B2E1347EA3864367B5F36329DA0E30FFA4482163170790B4F2D5629949030D8D8B8429E709
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........0.........#...#.....,.....................k.................................|........ ......................`.......p..l...............................P....................................................p...............................text...$...........................`.P`.data...0...........................@.0..rdata...g.......h..................@.`@/4......T$... ...&..................@.0@.bss.........P........................0..edata.......`......................@.0@.idata..l....p......."..............@.0..CRT....,............&..............@.0..tls.................(..............@.0..reloc..P............*..............@.0B................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\libssl-1_1.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):552216
                                        Entropy (8bit):5.779566253639773
                                        Encrypted:false
                                        SSDEEP:12288:MaYPTKwDsuz9V/9SYeujF59CF5e3SnEEATLU2lvzS7u:nYPTRDD9ND58GqbATLU2lvzS7u
                                        MD5:8845FCF1AE2DE1018DAAAEA01D9BA2D5
                                        SHA1:DB67697EE052738E6F23CC1D29B261BEF1D423E5
                                        SHA-256:B7E16AF3EFF9AB0869CFE60C256394A70A867879B7F56544A724D6AC1CCFAB88
                                        SHA-512:2792FE94DD35B594514C4FAD091C9683EC47814335D046F776CD1F043C576533E99088949F1F1AE6814C16DBDDA430EC53B2D64621EA0C818CADB91EC5E3A788
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x.._x.._x.._qf._t.._7b.^z.._3f.^z.._7b.^s.._7b.^r.._7b.^z.._.b.^{.._x.._..._.b.^T.._.b.^y.._.ba_y.._.b.^y.._Richx.._........................PE..L......c...........!...".....4......."....... ......................................P.....@......................... =...N...........0..s............>.../...@...6...,..8............................+..@............................................text...-........................... ..`.rdata..*k... ...l..................@..@.data....;.......6...|..............@....idata..dA.......B..................@..@.00cfg....... ......................@..@.rsrc...s....0......................@..@.reloc..)>...@...@..................@..B........................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\libusb-1.0.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):219662
                                        Entropy (8bit):6.498800717506742
                                        Encrypted:false
                                        SSDEEP:3072:yL40BTtebjPofSJqYtdKZMy4ZKmJo5RFjXPicaW/jmkfEc7fNQ8juEnLQLyE:yXujMSgYtUZMy4ZKmJ2RFjXT/jmglB2
                                        MD5:F4A98FEA2565D76FC7AEE8195F955CD0
                                        SHA1:6FBBF899BA474419E21042CF81D7D9D4F12F1040
                                        SHA-256:E70158FEF09E1B5EE8BB416EC4F3ADA620C06E0ED54C44E850572E99863F43C3
                                        SHA-512:3A4987994A93F487782C89D8645CEF399D4AE21CEA75D36B9FD5E2ADC0253B3E975D947E73C046DE44BED99D0670E6E14BCB1F1EFD751FC9CCB0888B8A3A929B
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Z.........#...#.@...V...............P.....k................................=:........ ......................@.......`..$....................................................................................a...............................text....>.......@..................`.P`.data........P.......D..............@.`..rdata.......`.......H..............@.`@/4.......6.......8..................@.0@.bss.........0........................`..edata.......@... ..................@.0@.idata..$....`.......(..............@.0..CRT....,....p.......4..............@.0..tls.................6..............@.0..rsrc................8..............@.0..reloc...............>..............@.0B........................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\libzbar-0.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                        Category:dropped
                                        Size (bytes):281102
                                        Entropy (8bit):6.455757924389761
                                        Encrypted:false
                                        SSDEEP:6144:0nbKPzmx2iUlsLt1LaOdfPyb5Zrziwis7q63lI:0nbKPzmx2iUlsLHiH571lI
                                        MD5:042DA22F1B7CF72B878A62A0DB6C6080
                                        SHA1:6EEB12444A784E3469820AE7D4326382DBCC1DEE
                                        SHA-256:FBDC809E73A718ACDF291393223F1516F517CC3C2A5C2F0F4FFC26E0C8D9CCBA
                                        SHA-512:34CF16461FCD9C0AC996C5CA4BE1D7277F770364928195A261AC516B4669376E87F0F891D2C198ECE5FF03B41193EF1B544FA0902A6528E361FADF9557E95801
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........J.........#...#.8...F...............P.....j......................................... ......................0.......P................................... ..................................................TS...............................text...$6.......8..................`.P`.data........P.......<..............@.`..rdata...Z...`...\...J..............@.`@/4.......P.......R..................@.0@.bss......... ........................`..edata.......0......................@.0@.idata.......P......................@.0..CRT....0....p....... ..............@.0..tls................."..............@.0..rsrc................$..............@.0..reloc... ......."...(..............@.0B........................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\py.typed

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):27
                                        Entropy (8bit):3.9265716511782736
                                        Encrypted:false
                                        SSDEEP:3:SZeW0FOoc:SZeRFHc
                                        MD5:48734178084EF7F5C250997C28F8BDEE
                                        SHA1:4D7BB7A1D9B08B32C6FFBAFCE440959D0BC19788
                                        SHA-256:6D67B0F661E0332F0BA8CBBB46EA905C55CB071876091C747546D2C7EDF0138F
                                        SHA-512:A227E9E2B7FC025767B4363544B4C4A675A123A853E68C740E659E662C354030F655B8FDA1D6CDF57B58CCA32A4757195F76D7A4A93048D334F047E7693F3335
                                        Malicious:false
                                        Preview:# Marker file for PEP 561..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\chinese_simplified.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):5.097279386012455
                                        Encrypted:false
                                        SSDEEP:192:RC/PE+flkDFk4kVOAUAIXYP9laqCFd5zJ007:R4E65uYPVCFLzJ
                                        MD5:0C5517AB8EDB22EA7A61E44B28E96DA7
                                        SHA1:F902EE7E96CE48DE6404ADF644FA40E260D949FF
                                        SHA-256:5C5942792BD8340CB8B27CD592F1015EDF56A8C5B26276EE18A482428E7C5726
                                        SHA-512:F5B6D696A6B75BDEEACD0E0742D31EAA06CD683BB3C149052D82E0D47039534B23C82FC47FB193C86FF2B7C2B22F73CCC48CC500F09ABC5E228998D9BC413EF7
                                        Malicious:false
                                        Preview:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\chinese_traditional.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):8192
                                        Entropy (8bit):5.099678321615091
                                        Encrypted:false
                                        SSDEEP:192:UPmINi9ODjMzdZmIBI3C8+o95uECRdDGrRPY2+PDv:Ucfz7lqyHo9RCz2wLPDv
                                        MD5:00D0909E346B52006D1E9EF680B5A5FC
                                        SHA1:33E401BEA63F83A5EA84D78DDC7161809EF77F0B
                                        SHA-256:417B26B3D8500A4AE3D59717D7011952DB6FC2FB84B807F3F94AC734E89C1B5F
                                        SHA-512:1E2689A48317A12A6B4A6A74DE2241380FEF57B250FAFE6AB00A479DB85D12661F8C33749240C9CEC6535ACD7F91E71DCBA0BB8A27D1D32A3B76FE34797CAD5B
                                        Malicious:false
                                        Preview:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\czech.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):14945
                                        Entropy (8bit):4.229683397391918
                                        Encrypted:false
                                        SSDEEP:384:6kfPbFvdXqyyLlY3fIVKj7KyvKxv/FjZ305yyRvQcR5bJw:lbrXqyyLS31/Kyviv/FaAyttR59w
                                        MD5:38FD5E100D4604C2A844BB9BB9305975
                                        SHA1:33A09B9BC987AAA8560FFEF8A17459C99C63ED4A
                                        SHA-256:7E80E161C3E93D9554C2EFB78D4E3CEBF8FC727E9C52E03B83B94406BDCC95FC
                                        SHA-512:3D56A9D507B5B07A99B9D9924D8540944DD226D4B5050852027F09309A85513DB2E57C9186F70B8F8226C342C28EFCEDD1E8EDD507E1D39F8DA693CFAC0C39CA
                                        Malicious:false
                                        Preview:abdikace.abeceda.adresa.agrese.akce.aktovka.alej.alkohol.amputace.ananas.andulka.anekdota.anketa.antika.anulovat.archa.arogance.asfalt.asistent.aspirace.astma.astronom.atlas.atletika.atol.autobus.azyl.babka.bachor.bacil.baculka.badatel.bageta.bagr.bahno.bakterie.balada.baletka.balkon.balonek.balvan.balza.bambus.bankomat.barbar.baret.barman.baroko.barva.baterka.batoh.bavlna.bazalka.bazilika.bazuka.bedna.beran.beseda.bestie.beton.bezinka.bezmoc.beztak.bicykl.bidlo.biftek.bikiny.bilance.biograf.biolog.bitva.bizon.blahobyt.blatouch.blecha.bledule.blesk.blikat.blizna.blokovat.bloudit.blud.bobek.bobr.bodlina.bodnout.bohatost.bojkot.bojovat.bokorys.bolest.borec.borovice.bota.boubel.bouchat.bouda.boule.bourat.boxer.bradavka.brambora.branka.bratr.brepta.briketa.brko.brloh.bronz.broskev.brunetka.brusinka.brzda.brzy.bublina.bubnovat.buchta.buditel.budka.budova.bufet.bujarost.bukvice.buldok.bulva.bunda.bunkr.burza.butik.buvol.buzola.bydlet.bylina.bytovka.bzukot.capart.carevna.cedr.cedule.cejch.cej

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\english.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):13116
                                        Entropy (8bit):4.2192956006819475
                                        Encrypted:false
                                        SSDEEP:192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
                                        MD5:F23506956964FA69C98FA3FB5C8823B5
                                        SHA1:B2D5241AE027A0E40F06A33D909809A190F210FE
                                        SHA-256:2F5EED53A4727B4BF8880D8F3F199EFC90E58503646D9FF8EFF3A2ED3B24DBDA
                                        SHA-512:416C71BA30018EA292BB36CDC23C9329673485A8D8933266A9D9A7CC72153B8BAED3D430F52EAB4F5D3ADDF6583611B3777A50454599F1E42716F5F879621123
                                        Malicious:false
                                        Preview:abandon.ability.able.about.above.absent.absorb.abstract.absurd.abuse.access.accident.account.accuse.achieve.acid.acoustic.acquire.across.act.action.actor.actress.actual.adapt.add.addict.address.adjust.admit.adult.advance.advice.aerobic.affair.afford.afraid.again.age.agent.agree.ahead.aim.air.airport.aisle.alarm.album.alcohol.alert.alien.all.alley.allow.almost.alone.alpha.already.also.alter.always.amateur.amazing.among.amount.amused.analyst.anchor.ancient.anger.angle.angry.animal.ankle.announce.annual.another.answer.antenna.antique.anxiety.any.apart.apology.appear.apple.approve.april.arch.arctic.area.arena.argue.arm.armed.armor.army.around.arrange.arrest.arrive.arrow.art.artefact.artist.artwork.ask.aspect.assault.asset.assist.assume.asthma.athlete.atom.attack.attend.attitude.attract.auction.audit.august.aunt.author.auto.autumn.average.avocado.avoid.awake.aware.away.awesome.awful.awkward.axis.baby.bachelor.bacon.badge.bag.balance.balcony.ball.bamboo.banana.banner.bar.barely.bargain.barre

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\french.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):16777
                                        Entropy (8bit):4.213242727095934
                                        Encrypted:false
                                        SSDEEP:384:6J+AAri16KDuR4ckw3ezywsNB7CJEu4XjooTiOPMk8YTCm:6IAYi16muR4GezyhNB7r0HG8EP
                                        MD5:F5905FD22FD0DEB0BE40F356204BA3FB
                                        SHA1:BCD81ED81906BDAB57D9700A23413A7E22487D0E
                                        SHA-256:EBC3959AB7801A1DF6BAC4FA7D970652F1DF76B683CD2F4003C941C63D517E59
                                        SHA-512:001B2E7D1D17416776FA5306E4F7EC5812F3F35CC26FDE46800A7DAB1412870AC8B779B0C2FEC1D75C24B80868E55BC5BFB88C8DED50C84040248B76A2C5332D
                                        Malicious:false
                                        Preview:abaisser.abandon.abdiquer.abeille.abolir.aborder.aboutir.aboyer.abrasif.abreuver.abriter.abroger.abrupt.absence.absolu.absurde.abusif.abyssal.acade.mie.acajou.acarien.accabler.accepter.acclamer.accolade.accroche.accuser.acerbe.achat.acheter.aciduler.acier.acompte.acque.rir.acronyme.acteur.actif.actuel.adepte.ade.quat.adhe.sif.adjectif.adjuger.admettre.admirer.adopter.adorer.adoucir.adresse.adroit.adulte.adverbe.ae.rer.ae.ronef.affaire.affecter.affiche.affreux.affubler.agacer.agencer.agile.agiter.agrafer.agre.able.agrume.aider.aiguille.ailier.aimable.aisance.ajouter.ajuster.alarmer.alchimie.alerte.alge.bre.algue.alie.ner.aliment.alle.ger.alliage.allouer.allumer.alourdir.alpaga.altesse.alve.ole.amateur.ambigu.ambre.ame.nager.amertume.amidon.amiral.amorcer.amour.amovible.amphibie.ampleur.amusant.analyse.anaphore.anarchie.anatomie.ancien.ane.antir.angle.angoisse.anguleux.animal.annexer.annonce.annuel.anodin.anomalie.anonyme.anormal.antenne.antidote.anxieux.apaiser.ape.ritif.a

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\italian.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):16033
                                        Entropy (8bit):4.007887655086134
                                        Encrypted:false
                                        SSDEEP:384:7TRlelKQfV+XsNs6d6NN5Qd3kR72+ImtKlhT3sdHy1WVO0iiG:7TmBtP7dwN5Qpi4lG1VO0a
                                        MD5:FBE635509A2859B7B6DE2C0F16F15ED8
                                        SHA1:C6214EB1CEC7B1EE8CBA1F317AC612C51881448A
                                        SHA-256:D392C49FDB700A24CD1FCEB237C1F65DCC128F6B34A8AACB58B59384B5C648C2
                                        SHA-512:D3DCA24CF03F04EEA1872D98C91748A8AA7AEAC6E2C885A99F2D452904A75FFCF271506DB369335726C0E3F7C8A6454935782586414B9AFFD2FE0EB004223DA1
                                        Malicious:false
                                        Preview:abaco.abbaglio.abbinato.abete.abisso.abolire.abrasivo.abrogato.accadere.accenno.accusato.acetone.achille.acido.acqua.acre.acrilico.acrobata.acuto.adagio.addebito.addome.adeguato.aderire.adipe.adottare.adulare.affabile.affetto.affisso.affranto.aforisma.afoso.africano.agave.agente.agevole.aggancio.agire.agitare.agonismo.agricolo.agrumeto.aguzzo.alabarda.alato.albatro.alberato.albo.albume.alce.alcolico.alettone.alfa.algebra.aliante.alibi.alimento.allagato.allegro.allievo.allodola.allusivo.almeno.alogeno.alpaca.alpestre.altalena.alterno.alticcio.altrove.alunno.alveolo.alzare.amalgama.amanita.amarena.ambito.ambrato.ameba.america.ametista.amico.ammasso.ammenda.ammirare.ammonito.amore.ampio.ampliare.amuleto.anacardo.anagrafe.analista.anarchia.anatra.anca.ancella.ancora.andare.andrea.anello.angelo.angolare.angusto.anima.annegare.annidato.anno.annuncio.anonimo.anticipo.anzi.apatico.apertura.apode.apparire.appetito.appoggio.approdo.appunto.aprile.arabica.arachide.aragosta.araldica.arancio.aratur

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\japanese.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):26423
                                        Entropy (8bit):3.554983747162495
                                        Encrypted:false
                                        SSDEEP:768:OwUkxkf27FkrH9tW/JgODfFFuHgFFqfw8QCBdqLMCl:Ogxkf27FkrdtW/JgOD9FuHgFFqfwLidW
                                        MD5:C71FCA9FD3FE9F85514CB38A58859DE2
                                        SHA1:A4EC1DA6C11A8C251195C7AD90817DDA6FE64488
                                        SHA-256:2EED0AEF492291E061633D7AD8117F1A2B03EB80A29D0E4E3117AC2528D05FFD
                                        SHA-512:3FAF87F7E48EB6635F7D7B18A34E7DACBC2C43A1CF6AA9C96015B2A3549710B8B7A0961E5D2E32D7E369099DB89A874C4D761A8384FB558744C7F47CA8CB0772
                                        Malicious:false
                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\korean.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):37832
                                        Entropy (8bit):3.7380887691649907
                                        Encrypted:false
                                        SSDEEP:384:m57ktAhYlpH/gN8G3Ufyy7+Lp5vx5fBECMLJbnSTyKeeHjbnHeRigUuVyS+sOpVl:MSWhGES2O/r6
                                        MD5:EC271D4926B82EF5C02AEFA7DD2DAAF4
                                        SHA1:6C5C5F38E75673D1CEA20F2700468ADC163D869B
                                        SHA-256:9E95F86C167DE88F450F0AAF89E87F6624A57F973C67B516E338E8E8B8897F60
                                        SHA-512:E645A1E0F26F2727A8FB7605D3B59668A670C9DF04D07576FE473D844A23D0192020AEDC286FBB9B1F64709AD30E6ACB825803CF9F872954C1324AEFD4977710
                                        Malicious:false
                                        Preview:..................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\portuguese.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text
                                        Category:dropped
                                        Size (bytes):15671
                                        Entropy (8bit):4.053540036444415
                                        Encrypted:false
                                        SSDEEP:384:XM3AG0Qk5DN0Wf3MmmzpjbdU5nTEHkYk0h3Vcf+VDG:c3AQMJ0Wf3HWby5QHkY9Vcf+tG
                                        MD5:05EE6FDE129776830351BBACD5B0DCFB
                                        SHA1:472727867B394A1C9168690C415B0094DC3A3383
                                        SHA-256:2685E9C194C82AE67E10BA59D9EA5345A23DC093E92276FC5361F6667D79CD3F
                                        SHA-512:0E6AA42870C6F9A77BDA0931EA9423FEBFFEFBEB49E9DBDA5FA732FC3479942629050517FEF57BB1A76026195E16785186C0CFE26261C8FCC31F52FE69BEDA0F
                                        Malicious:false
                                        Preview:abacate.abaixo.abalar.abater.abduzir.abelha.aberto.abismo.abotoar.abranger.abreviar.abrigar.abrupto.absinto.absoluto.absurdo.abutre.acabado.acalmar.acampar.acanhar.acaso.aceitar.acelerar.acenar.acervo.acessar.acetona.achatar.acidez.acima.acionado.acirrar.aclamar.aclive.acolhida.acomodar.acoplar.acordar.acumular.acusador.adaptar.adega.adentro.adepto.adequar.aderente.adesivo.adeus.adiante.aditivo.adjetivo.adjunto.admirar.adorar.adquirir.adubo.adverso.advogado.aeronave.afastar.aferir.afetivo.afinador.afivelar.aflito.afluente.afrontar.agachar.agarrar.agasalho.agenciar.agilizar.agiota.agitado.agora.agradar.agreste.agrupar.aguardar.agulha.ajoelhar.ajudar.ajustar.alameda.alarme.alastrar.alavanca.albergue.albino.alcatra.aldeia.alecrim.alegria.alertar.alface.alfinete.algum.alheio.aliar.alicate.alienar.alinhar.aliviar.almofada.alocar.alpiste.alterar.altitude.alucinar.alugar.aluno.alusivo.alvo.amaciar.amador.amarelo.amassar.ambas.ambiente.ameixa.amenizar.amido.amistoso.amizade.amolador.amontoar.a

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\russian.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):26538
                                        Entropy (8bit):3.827508989563015
                                        Encrypted:false
                                        SSDEEP:384:ou+5yukI02DpvaXhg8CnLOTsPsyOB7lanqA1p6tut/Mf2:H+5SIjDpvaXhrUSTsPsBBpand7xxMf2
                                        MD5:8950901A308B43D263E31A377306D987
                                        SHA1:7792B55B1838FAA8928C2528D304C2044ECD87BF
                                        SHA-256:07F11AF3F07FD13D8D74859F4448D8BCA8F1D9D336DC4842531ECEA083103A26
                                        SHA-512:5B747B7345E23F34DAFB35AFD9C2CB66AAD51456A7ACCBD9BF9CA7C285498A74C50647DA4D553AF763505935E1519F61204DB87D998B09583CC2585C91833B6B
                                        Malicious:false
                                        Preview:.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\spanish.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):13996
                                        Entropy (8bit):4.187487403267613
                                        Encrypted:false
                                        SSDEEP:384:7SvbJ9E182qrUD0py4gnW6ji3Jl3ggHQqy8:s9ET1DsyXnne3xX
                                        MD5:5171EE312F7709BEC7660BC9AC07351A
                                        SHA1:B99205D24970E0ADA8E2182A1A68F1EB439C95A1
                                        SHA-256:46846A5A0139D1E3CB77293E521C2865F7BCDB82C44E8D0A06A2CD0ECBA48C0B
                                        SHA-512:0E838229265DE6C80505088682D2DC9510147C3AB1713B556B594D09529B493CC3A7E391AD690DDA2052D4E11C56572F8A215A7FFFDB2630B13B4637329F3C31
                                        Malicious:false
                                        Preview:a.baco.abdomen.abeja.abierto.abogado.abono.aborto.abrazo.abrir.abuelo.abuso.acabar.academia.acceso.accio.n.aceite.acelga.acento.aceptar.a.cido.aclarar.acne..acoger.acoso.activo.acto.actriz.actuar.acudir.acuerdo.acusar.adicto.admitir.adoptar.adorno.aduana.adulto.ae.reo.afectar.aficio.n.afinar.afirmar.a.gil.agitar.agoni.a.agosto.agotar.agregar.agrio.agua.agudo.a.guila.aguja.ahogo.ahorro.aire.aislar.ajedrez.ajeno.ajuste.alacra.n.alambre.alarma.alba.a.lbum.alcalde.aldea.alegre.alejar.alerta.aleta.alfiler.alga.algodo.n.aliado.aliento.alivio.alma.almeja.almi.bar.altar.alteza.altivo.alto.altura.alumno.alzar.amable.amante.amapola.amargo.amasar.a.mbar.a.mbito.ameno.amigo.amistad.amor.amparo.amplio.ancho.anciano.ancla.andar.ande.n.anemia.a.ngulo.anillo.a.nimo.ani.s.anotar.antena.antiguo.antojo.anual.anular.anuncio.an.adir.an.ejo.an.o.apagar.aparato.apetito.apio.aplicar.apodo.aporte.apoyo.aprender.aprobar.apuesta.apuro.arado.aran.a.arar.a.rbitro.a.rbol.arbusto.archivo.arc

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\mnemonic\wordlist\turkish.txt

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:Unicode text, UTF-8 text
                                        Category:dropped
                                        Size (bytes):15324
                                        Entropy (8bit):4.562888468144625
                                        Encrypted:false
                                        SSDEEP:384:RyHE73AnXs3FzmzZIPXJBmqM0yHvnWMGRUIHF3N09GU:RWE7QnX6PPX7M0yPnvGHl3N0GU
                                        MD5:BA9ADCC5210C101DF4B26871504F253D
                                        SHA1:C0AEDCD8297FB58456C0A60854E04B547DFC9576
                                        SHA-256:A7DC9C77913726106C7B8BAA022B7E17601D118ACF40AA60AB1FBC9C91B383AC
                                        SHA-512:D16BADD39006E06FC5AD03AA7AA622ED19A19271E300061183BFA7A2F913919E8A0C831BC74FA3E6DEE1EC35AF01AC904D2617EC3EF7DFA3FADE6EBEF788E218
                                        Malicious:false
                                        Preview:abajur.abak.s.abart..abdal.abdest.abiye.abluka.abone.absorbe.abs.rt.acayip.acele.acemi.a..kg.z.adalet.adam.adezyon.adisyon.adliye.adres.afacan.afili.afi..afiyet.aforizm.afra.a.a..a..r.ahbap.ahkam.ahlak.ahtapot.aidat.aile.ajan.akademi.akarsu.akba..akci.er.akdeniz.ak.bet.ak.l.ak.nt..akide.akrep.akrobasi.aksiyon.ak.am.aktif.akt.r.aktris.akustik.alaca.alb.m.al.ak.aldanma.aleni.alet.alfabe.alg.lama.al.ngan.alk...alkol.alpay.alperen.alt.n.alt.st.altyap..alyuvar.amade.amat.r.amazon.ambalaj.amblem.ambulans.amca.amel.amigo.amir.amiyane.amorti.ampul.anadolu.anahtar.anakonda.anaokul.anapara.anar.i.anatomi.anayasa.anekdot.anestezi.angaje.anka.anket.anlaml..anne.anomali.anonim.anten.antla.ma.apse.araba.arac..araf.arbede.arda.arefe.arena.argo.arg.man.arkada..armoni.aroma.arsa.ars.z.art..artist.aruz.asans.r.asayi..asfalt.asgari.asil.asker.ask..aslan.asosyal.astsubay.asya.a....a..r..a.ure.atabey.ataman.ate..atmaca.atmosfer.atom.at.lye.avc..avdet.avize.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\pyexpat.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):170264
                                        Entropy (8bit):6.693484567356425
                                        Encrypted:false
                                        SSDEEP:3072:M5QtHVOqzYcylPwZzS8JqTuo0BmSWjIuVBY/xux08YvVILLh8ptCuX5x+:M2tHjzYcyu+unESWXA/xaYvD0
                                        MD5:92C72753FA5C8EAA615B007F89CDB482
                                        SHA1:34238E31E0D963838FF551B184EAB3267767AD12
                                        SHA-256:EBBDE07AFB2BB356CD400E97D8AFB5ABBC121CC0CC90F99BEC9C3FA5CA60DE14
                                        SHA-512:A80BBA7095E7178591266E411414B3A6A2CBA09B79F330631AC07A72C6EB2AFD1C50D7346938ED337A911307B15660C17D14FACC7AFC6EFD9759BFBEC2121BD6
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i^C.-?-.-?-.-?-.$G..#?-..J,./?-..J(.!?-..J).'?-..J../?-..J,./?-.fG,..?-.-?,._?-..J%.)?-..J-.,?-..J..,?-..J/.,?-.Rich-?-.........PE..L...M.,d...........!......................................................................@..........................:..P...`:.......p...............j.../......( ...5..T............................5..@............................................text............................... ..`.rdata...U.......V..................@..@.data........P.......2..............@....rsrc........p.......>..............@..@.reloc..( ......."...H..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\python3.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):65816
                                        Entropy (8bit):6.185813124894273
                                        Encrypted:false
                                        SSDEEP:768:rU8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqv:rUwewnvtjnsfwIVILL0s7SytPxS
                                        MD5:CD87B0D055B7ECE0C469A2562EDE9DD3
                                        SHA1:0EC9300BC910D5CECE38869AAD4FF8A28F10A09B
                                        SHA-256:260B946068120C33460F0992C01AD413B6D464A056CB0D1F83C39FCBCC2FCBAB
                                        SHA-512:290D4DFFA1E4A897BF12A971CEF59149749BB980F2DB3DBD0C907FC6C6544456A9C58D89A5BCDDB8151BC5260A268646A95FBCFE5A5C3AD69F94B271A3B622E4
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A.d.A.d.A.d...l.@.d...d.@.d.....@.d...f.@.d.RichA.d.PE..L...!.,d...........!......................................................................@.........................`...`................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@....!.,d........7...............!.,d........................!.,d........|...$...$...........................D1......F...F............*..^1...1...1...1...2..B2..x2...2...2..&3..L3..w3...3...3...4..P4...4...4...4...5..=5..p5...5...5...6..56..f6...6...6...6../7..S7..w7...7...7...8..<8..j8...8...8...8...9..<9..g9...9...9...:..3:..c:...:...:...:...;..R;...;...;...;..#<..[<...<...<...<...=..?=...=...=...=..&>..[>...>...>...>..+?.._?...?...?...@..E@..}@...@...@...A..>A..lA...A...A...A..+B..

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\python310.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):4143384
                                        Entropy (8bit):6.719606889163802
                                        Encrypted:false
                                        SSDEEP:49152:0izdDWQcAdLh1ckY/wqIEh8rvZGsIBGfHP2MZnaPxQ1w7OEnGI8wgJyf:0uAk3rWBcH+MZ0Q1wlnYZJY
                                        MD5:73CADAB187AD5E06BEF954190478E3AA
                                        SHA1:18AB7B6FE86193DF108A5A09E504230892DE453E
                                        SHA-256:B4893ED4890874D0466FCA49960D765DD4C2D3948A47D69584F5CC51BBBFA4C9
                                        SHA-512:B2EBE575F3252FF7ABEBAB23FC0572FC8586E80D902D5A731FB7BD030FAA47D124240012E92FFE41A841FA2A65C7FB110AF7FB9AB6E430395A80E925283E2D4D
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............p.......jf......p.......p.......p.......}.......}...............p.......p.......pd......p......Rich............PE..L.....,d...........!......$...........$.......$...............................B......3@...@..........................%:.......:.|.....?...............?../....?.l1..(.9.T.............................9.@.............$..............................text.....$.......$................. ..`.rdata...F....$..H....$.............@..@.data.........;.......:.............@...PyRuntimh.....?.......<.............@....rsrc.........?.......<.............@..@.reloc..l1....?..2....<.............@..B................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bcash_tx_502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1885
                                        Entropy (8bit):5.255142499174794
                                        Encrypted:false
                                        SSDEEP:24:YVNA5wP62ZawdeqFWNA5K2ZWEEnSFjrDEfewL1ln5bqAvpHBdgSGCWYEH8XSk5Ea:Yni2Iwdo2o2rrA/qABHBdg81SyxHSJo
                                        MD5:D11BCE86BBB84EEDB70042A410931BB3
                                        SHA1:C5B0F891BD08421920B17B89F1777FAEB629D28B
                                        SHA-256:8CFB4D1D0C5C4CF36E231D9955DD38F460E33D5CC219AFFF48B422D980504BC2
                                        SHA-512:072ADA09F6DC9ED39E9849B7059BACD54A8993C2295A3AA3E570E72D3502082A773A32D49FBC52AC81DD1D2483D30D0D58CF38998AC45129BECE3D11D7D4188F
                                        Malicious:false
                                        Preview:{"vout": [{"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 b1401fce7e8bf123c88a0467e0ed11e3b9fbef54 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1HADRPJpgqBzThepERpVXNi6qRgiLQRNoE"], "hex": "76a914b1401fce7e8bf123c88a0467e0ed11e3b9fbef5488ac"}, "n": 0, "spentHeight": 478743, "value": "0.01896050", "spentTxId": "5594fd9e5e26dcb4437cbbbba517401720849159bac4e2158e1e6401ffd5fdb7", "spentIndex": 0}, {"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 d51eca49695cdf47e7f4b55507893e3ad53fe9d8 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1LRspCZNFJcbuNKQkXgHMDucctFRQya5a3"], "hex": "76a914d51eca49695cdf47e7f4b55507893e3ad53fe9d888ac"}, "n": 1, "spentHeight": 478743, "value": "0.00073452", "spentTxId": "5594fd9e5e26dcb4437cbbbba517401720849159bac4e2158e1e6401ffd5fdb7", "spentIndex": 1}], "fees": 0.00025842, "size": 225, "confirmations": 383, "blockheight": 478743, "txid": "502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c", "blockhash": "0000000000000

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bcash_tx_8b6db9b8ba24235d86b053ea2ccb484fc32b96f89c3c39f98d86f90db16076a0.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2028
                                        Entropy (8bit):4.96188924342764
                                        Encrypted:false
                                        SSDEEP:24:YV7UzUiK2FocJxxw8O3VcRfnXqqhxZkCWOMS2Q0NCIZm0xttyR2QrIZmRttyG1nn:Y9UpKgxgMvq4sRttyL0qttyu
                                        MD5:E17D0CCA6B9442822B1DB16937DB0DE7
                                        SHA1:BC4DDD686E0270894F882DCCE0064F7684B2F373
                                        SHA-256:CFC6E06077329625E665010F1DEFBFFAEC067C530590F5643C8D82AD385E4EF9
                                        SHA-512:F6C9FAE92AF950E459E519A7D9AEDD17168914FE4AD178872D7645DF286710967E14B3B660A8C8DB45F8C91706C6074C4586D9229A8AA833185E397ABD442DF4
                                        Malicious:false
                                        Preview:{"vout": [{"scriptPubKey": {"type": "scripthash", "asm": "OP_HASH160 11c1566006ab2b8e8c8d981055b090ecdefa9771 OP_EQUAL", "addresses": ["33Ju286QvonBz5N1V754ZekQv4GLJqcc5R"], "hex": "a91411c1566006ab2b8e8c8d981055b090ecdefa977187"}, "n": 0, "spentHeight": -1, "value": "0.00048490", "spentTxId": "f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f", "spentIndex": 0}], "fees": 1.51e-05, "size": 338, "confirmations": 5, "blockheight": 479121, "txid": "8b6db9b8ba24235d86b053ea2ccb484fc32b96f89c3c39f98d86f90db16076a0", "blockhash": "000000000000000004d736cdc6be7912951849d6a96e8118a5009373d51aa422", "blocktime": 1502563143, "valueOut": 0.0004849, "vin": [{"vout": 0, "n": 0, "valueSat": 50000, "doubleSpentTxID": null, "addr": "3LJVbFT3mKw46FMwQuDvUt5xFQBFsLkknn", "value": 0.0005, "sequence": 4294967294, "txid": "5f72ec264d961dfdd460a9cc22743c795127b129d40be8087244d93b3f7eee11", "scriptSig": {"asm": "0 3045022100e87e3ae6ac22ccbaa8a5800b2bbd81aad9ff56e0fc6993953635fd9ee85e49f1022049

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bcash_tx_bc37c28dfb467d2ecb50261387bf752a3977d7e5337915071bb4151e6b711a78.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1472
                                        Entropy (8bit):5.16997579741517
                                        Encrypted:false
                                        SSDEEP:24:YVNA5XaT2ZoS9COfeZF4yhl1BdgSPOnCUtJCrpDjlCWTmUtSj4qmUtSwk1neY:YJT2C7UinBdggXwJTgSIgSF
                                        MD5:F5F7FE7C16A3462A48D4443489B36CF5
                                        SHA1:7B641C5C80FE555E227027B405843CAAAA465ED6
                                        SHA-256:3F4E12FDAC7E408F5BDAF52EEA53B0751D3C3A534CD9E6C0D3246F1F05433FAD
                                        SHA-512:87A93F35C12216270D2E2772C5F5F9DD04E65E2F8C9C66FEFC605EA766FA2BDB18D954F46809AE2ABEAD119A6653CC7CCEA11C10EBD4D9012BF3CCCE2DACD01B
                                        Malicious:false
                                        Preview:{"vout": [{"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 de701ce12e576395c863e9377c76dd7efe0c55c1 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1MH9KKcvdCTY44xVDC2k3fjBbX5Cz29N1q"], "hex": "76a914de701ce12e576395c863e9377c76dd7efe0c55c188ac"}, "n": 0, "spentHeight": 478743, "value": "0.01995344", "spentTxId": "502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c", "spentIndex": 0}], "fees": 4.656e-05, "size": 192, "confirmations": 503, "blockheight": 478623, "txid": "bc37c28dfb467d2ecb50261387bf752a3977d7e5337915071bb4151e6b711a78", "blockhash": "000000000000000004cc670aab354e9593d789ec091d571f99fb4ad67ec865a2", "blocktime": 1501857558, "valueOut": 0.01995344, "vin": [{"vout": 1, "n": 0, "valueSat": 2000000, "doubleSpentTxID": null, "addr": "1DS6LVgFWZBGVin3y5B9emUxHtnuQetp9L", "value": 0.02, "sequence": 4294967295, "txid": "8d566ad80d5f1d3887d3acddb35b980641919e6efa7c3a3a78413e56f95ea516", "scriptSig": {"asm": "3045022100860b4c43649f86ee603c13791646af4736c

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bcash_tx_f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2268
                                        Entropy (8bit):5.109000243989634
                                        Encrypted:false
                                        SSDEEP:48:YWLiqKmDdO1C2WHcgcHUZrVG1ZK+uZBe5rVG1ZK+uV6eP:fWwE1C2WHcHHqrVYvH5rVYvheP
                                        MD5:F7D8526E29FABE3A1285D411AB8896E0
                                        SHA1:CB7AF6389EFA5B8EDDA90CE46FDFCF4C42DE4C43
                                        SHA-256:4931DF379CF798B2CDA0AEF40808636E68CF15EAA0D5BF529D9D6C900C65A435
                                        SHA-512:6C3E2E26E198A0AF4C026FCA0875AF9236F5A37B35914550AB65F17D26EB9011F4397C97533D15CDE1B3EBE5017EB1D26A20792ECA42AA01C37FA5A072C95853
                                        Malicious:false
                                        Preview:{"version": 1, "fees": 4.9e-06, "valueIn": 0.0004849, "valueOut": 0.00048, "locktime": 0, "txid": "f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f", "size": 373, "time": 1502564873, "confirmations": 0, "blockheight": -1, "vout": [{"spentIndex": null, "n": 0, "spentHeight": null, "value": "0.00024000", "scriptPubKey": {"hex": "76a91400741952f6a6eab5394f366db5cc5a54b0c2429f88ac", "type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 00741952f6a6eab5394f366db5cc5a54b0c2429f OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["113Q5hHQNQ3bc1RpPX6UNw4GAXstyeA3Dk"]}, "spentTxId": null}, {"spentIndex": 0, "n": 1, "spentHeight": -1, "value": "0.00024000", "scriptPubKey": {"hex": "a914756c06d7e77de3950a6124f026d8e1a2464b3ecf87", "type": "scripthash", "asm": "OP_HASH160 756c06d7e77de3950a6124f026d8e1a2464b3ecf OP_EQUAL", "addresses": ["3CPtPpL5mGAPdxUeUDfm2RNdWoSN9dKpXE"]}, "spentTxId": "db845018e2049b0d81fca81cfec585cde9a50bae81ae095d53ee86ffd5f8c99b"}], "vin": [{"sequence": 4294967295, "valu

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_gold_tx_25526bf06c76ad3082bba930cf627cdd5f1b3cd0b9907dd7ff1a07e14addc985.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1138
                                        Entropy (8bit):5.266045788316132
                                        Encrypted:false
                                        SSDEEP:24:Y7MlpeZgEVv3P9FhRnelR5sel22Zrh9qIxwgqvKIZcN8ZJxInenRw:Yg0v3pBemeA2ljRxwFvxl7w
                                        MD5:C0A65537E2D1226B9ADE8277BBBA3E20
                                        SHA1:F398CBD84987A4B813709D10B165A32307332007
                                        SHA-256:6959BAC4284CB9B4F6D14EDA6EFCC8D9E9FB623FEB689B5AAAD6DAEFDADA73BD
                                        SHA-512:A503F6063E545A0412AC6BFD4988DAB2C66AEA9551414D1467DF0101F612880FC76F6CE2EEC4322CDA121B70133A16254A9D24FA3C94E4025C18F59158DA208D
                                        Malicious:false
                                        Preview:{"txid": "25526bf06c76ad3082bba930cf627cdd5f1b3cd0b9907dd7ff1a07e14addc985", "version": 1, "locktime": 0, "vin": [{"coinbase": "03b4e407005a2d4e4f4d50212068747470733a2f2f6769746875622e636f6d2f6a6f7368756179616275742f7a2d6e6f6d70", "sequence": 4294967295, "n": 0}], "vout": [{"value": "12.52382934", "n": 0, "scriptPubKey": {"hex": "76a9140cb60a52559620e5de9a297612d49f55f7fd14ea88ac", "asm": "OP_DUP OP_HASH160 0cb60a52559620e5de9a297612d49f55f7fd14ea OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["GK18bp4UzC6wqYKKNLkaJ3hzQazTc3TWBw"], "type": "pubkeyhash"}, "spentTxId": null, "spentIndex": null, "spentHeight": null}, {"value": "0.00000000", "n": 1, "scriptPubKey": {"hex": "6a24aa21a9eddb3ac2bba12721c8db157ba6b522196093d3a27a8083591a2b785a230a1d254f", "asm": "OP_RETURN aa21a9eddb3ac2bba12721c8db157ba6b522196093d3a27a8083591a2b785a230a1d254f"}, "spentTxId": null, "spentIndex": null, "spentHeight": null}], "blockhash": "000000000b9f4d15e03603463f536b7b9da695580ae8b8bcdac5970195b586f4", "blockhei

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_gold_tx_db77c2461b840e6edbe7f9280043184a98e020d9795c1b65cb7cef2551a8fb18.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2134
                                        Entropy (8bit):5.112227801446302
                                        Encrypted:false
                                        SSDEEP:48:YEfJPPJzJW8eBO9TjfNTjjJW8cvr12WRl3Kn:rBZVPeB8TjlTjlPcJ2WRon
                                        MD5:26ECF15DAFE18BA40D5F79C05399C31D
                                        SHA1:3A89B6CCD0B8CBC6ACF1E39B1E572C4AF1D6B94B
                                        SHA-256:F0E729A973CCBF572F0690FF0FC51498C319C7C86CF4F19C37FE18D06CF560DB
                                        SHA-512:D385AF66E4B26458279F58F873D813F79B7A54FE7E73DD59DC45C6074BA17B0D3D4EA6F479081A4C7C114C3A4E78361A83CD284E174A06FF6CC73CCBF95598FA
                                        Malicious:false
                                        Preview:{"txid": "db77c2461b840e6edbe7f9280043184a98e020d9795c1b65cb7cef2551a8fb18", "version": 1, "locktime": 0, "vin": [{"txid": "52fb172f86926a89a16edf55bc9baec3929149b7cd2d2389be3c7d08d744d300", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "4830450221008bff524a092086372a19b924f41fa7fa2a5523bf42a4801b9503fcdfff2094e8022000f223a032bd0d7fee31d5663cd5cf86b82533bda6871366d519a68deae1042341210222c6760cc54de6fd7f2a40207a13137d497c7cdb472376523700d8ea88275a96", "asm": "30450221008bff524a092086372a19b924f41fa7fa2a5523bf42a4801b9503fcdfff2094e8022000f223a032bd0d7fee31d5663cd5cf86b82533bda6871366d519a68deae10423[ALL|FORKID] 0222c6760cc54de6fd7f2a40207a13137d497c7cdb472376523700d8ea88275a96"}, "addr": "GgdFx96JSR3nbyhtgxqsUessZLarxLWA3J", "valueSat": 2128176, "value": "0.02128176", "doubleSpentTxID": null}, {"txid": "371eb4feaa4085b378bb825f3c1b457867c24211ee838584b1adac226bba654b", "vout": 0, "sequence": 4294967295, "n": 1, "scriptSig": {"hex": "47304402206aee1d853479782029755dd3c3

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_1570416eb4302cf52979afd5e6909e37d8fdd874301f7cc87e547e509cb1caa6.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1743
                                        Entropy (8bit):5.31554870261559
                                        Encrypted:false
                                        SSDEEP:24:YNVCdNww5F2ZNCdNE22u5k+2ZBCxBnlLsCxS7GpT8NyqzGpTvNy5uy0ClrUuf:YNVCwG2HCv72INsCQ6+ym6hy5uydrn
                                        MD5:376238DF160736D6ED70A5F768F63926
                                        SHA1:E75982C04D34105307A50954F2252E4D297AC08B
                                        SHA-256:D6169B5B04EE8CB9E33AFE7785793156CC79E902986C1170AD806322CD1DF4B1
                                        SHA-512:7C9DCD64E263FFA57DF818F026F231E2F69783FE182E3907CB05B355FD8DB23B85FA1BA2DAB9E6EEADA536DBBEC291447C4803EF49861F43BBC936E729AC93E2
                                        Malicious:false
                                        Preview:{"valueOut": 2.2016, "vout": [{"spentIndex": null, "spentHeight": null, "value": "1.00000000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b5089282a2e18305dbb01ee5e6c40b81993c96be88ac", "addresses": ["1HWDaLTpTCTtRWyWqZkzWx1wex5NKyncLW"], "asm": "OP_DUP OP_HASH160 b5089282a2e18305dbb01ee5e6c40b81993c96be OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "1.20160000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914d00f6606ddd5bfa271dd96848b9a682455af711e88ac", "addresses": ["1Ky7zozX19ULmzCLK7CGhX2BFj2moyUp5c"], "asm": "OP_DUP OP_HASH160 d00f6606ddd5bfa271dd96848b9a682455af711e OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000015e982463c967e1419784ef9da717344068bf7faaf9ab55", "valueIn": 2.2026, "fees": 0.001, "vin": [{"addr": "12vp7HFNua4VSjpswBhCfJJVhvqs8gkrUR", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 2.2026, "n": 0, "valueSat": 220260000, "txid

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_39a29e954977662ab3879c66fb251ef753e0912223a83d1dcb009111d28265e5.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2013
                                        Entropy (8bit):5.210033940318343
                                        Encrypted:false
                                        SSDEEP:48:Ym4E2J2RphYrJ2yaNpXllb8gwgQ/OVfgQKOVo6:WjJ2RpUJ2nNpXD9wgQufgQrv
                                        MD5:EF02F292588E0B6DA2A5C0CA59E7FBC1
                                        SHA1:6DC83D80B8072F89268F6BC9B6CCA86F8102EF1F
                                        SHA-256:999705A47A02503E121CB010E10801699B871E920C395D34ED2B5DD265001D4C
                                        SHA-512:7C21524C8ED47289BBD9581AA09DF15B566A3C3391F655A335E07964B1BC9582DAC97DA9B126673AAB1569992FE0800F8619F641A4525B7D533EC83F4D2E7A7A
                                        Malicious:false
                                        Preview:{"valueOut": 3.00986058, "vout": [{"spentIndex": 30, "spentHeight": 288729, "value": "2.98446058", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9149ef561f8f6fe602cba796137f2d56d7e8a0a4c8488ac", "addresses": ["1FVVioK1iE9X6cBZtarVj6e5vjMATc8izW"], "asm": "OP_DUP OP_HASH160 9ef561f8f6fe602cba796137f2d56d7e8a0a4c84 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 1, "spentHeight": 284875, "value": "0.02540000", "n": 1, "spentTxId": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914812c13d97f9159e54e326b481b8f88a73df8507a88ac", "addresses": ["1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5"], "asm": "OP_DUP OP_HASH160 812c13d97f9159e54e326b481b8f88a73df8507a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000016732dadfc971c98b308d46283f0340c0ad9479fc65a28550", "valueIn": 3.00996058, "fees": 0.0001, "vin": [{"addr": "1M2Qq4P8bjXrbvEYic

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):42348
                                        Entropy (8bit):5.371395930873508
                                        Encrypted:false
                                        SSDEEP:384:WPxPzPZP/P5PDPxPHPBP4PdPlP5PJP9PlPBPhPdPiPXP7P7PfPXPDPzPPP3P6PJX:N2m
                                        MD5:3F2818F8A6A0DF3D37B765C2A4F1ED32
                                        SHA1:ACDA62BE0EF474C8C905E2BA74264C3B21822168
                                        SHA-256:87E4526FFA0D2D07D678AD789533C42BB352B2ADB046BA534776E57D18B86EFD
                                        SHA-512:ED64C3116AC6FA7F6C1907F97ACA895A167298021B46607337DB1A0CDB99CA8BC540D41AE3613B1F590A9C002524E874FE2D1CE3013F163E2EE63633011212C5
                                        Malicious:false
                                        Preview:{"txid": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "version": 1, "locktime": 0, "vin": [{"txid": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "493046022100b0377607841d5c6ccac13193cb1e4ebd6ee2e5d64ea94701a96c27a79d2b965d022100b9cf65e0007fd0a96db67173cc331c8fd4bef9b6d644a2ae4cb9f7df74c2a265012103477b9f0f34ae85434ce795f0c5e1e90c9420e5b5fad084d7cce9a487b94a7902", "asm": "3046022100b0377607841d5c6ccac13193cb1e4ebd6ee2e5d64ea94701a96c27a79d2b965d022100b9cf65e0007fd0a96db67173cc331c8fd4bef9b6d644a2ae4cb9f7df74c2a265[ALL] 03477b9f0f34ae85434ce795f0c5e1e90c9420e5b5fad084d7cce9a487b94a7902"}, "addr": "1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5", "valueSat": 100000, "value": "0.001", "doubleSpentTxID": null}, {"txid": "39a29e954977662ab3879c66fb251ef753e0912223a83d1dcb009111d28265e5", "vout": 1, "sequence": 4294967295, "n": 1, "scriptSig": {"hex": "483045022100f908166e800b80ac2f907a90a1807a2fb

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_50f6f1209ca92d7359564be803cb2c932cde7d370f7cee50fd1fad6790f6206d.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1878
                                        Entropy (8bit):5.2309675071719175
                                        Encrypted:false
                                        SSDEEP:48:YsZ2WKLBIT2nTEzjPuFEtxuF5tK9pYaaIs+w:b2LeT2wfPeAxeDK9qIs+w
                                        MD5:C928D75F3BA685DCA38A932DB607D854
                                        SHA1:D4E1206F78B837518065BF9D1058045AB7A425F8
                                        SHA-256:5DE49B0260A492F36345937D608607C678CA59AA276405FB5ED1E675E0E2FB18
                                        SHA-512:8C3870673C28F69E21CE7CE146AA6EFB5045FDC93F49A3B292A22D15718318FBC6CE31FFFB073492E0C4EAB815D2BACE2DA8D0346EC0DB588897D9BB5305B309
                                        Malicious:false
                                        Preview:{"fees": 0.000113, "blocktime": 1423664307, "vout": [{"n": 0, "spentTxId": "f003c5c041d0708026e20ce97733f4561fb8c52e302692ac2e550aabe6c3912f", "value": "0.00113698", "spentHeight": 350552, "spentIndex": 0, "scriptPubKey": {"asm": "OP_DUP OP_HASH160 902c642ba3a22f5c6cfa30a1790c133ddf15cc88 OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914902c642ba3a22f5c6cfa30a1790c133ddf15cc8888ac", "addresses": ["1E9KUz71DjP3rNk2Xibd1FwyHLWfbnhrCz"], "type": "pubkeyhash"}}, {"n": 1, "spentTxId": "c275c333fd1b36bef4af316226c66a8b3693fbfcc081a5e16a2ae5fcb09e92bf", "value": "0.00050000", "spentHeight": 344045, "spentIndex": 0, "scriptPubKey": {"asm": "OP_DUP OP_HASH160 a6450f1945831a81912616691e721b787383f4ed OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914a6450f1945831a81912616691e721b787383f4ed88ac", "addresses": ["1GA9u9TfCG7SWmKCveBumdA1TZpfom6ZdJ"], "type": "pubkeyhash"}}], "vin": [{"sequence": 4294967295, "addr": "15T9DSqc6wjkPxcr2MNVSzF9JAePdvS3n1", "n": 0, "vout": 0, "scriptSig": {"asm": "304402204ec6818b86

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_54aa5680dea781f45ebb536e53dffc526d68c0eb5c00547e323b2c32382dfba3.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2016
                                        Entropy (8bit):5.193835433186479
                                        Encrypted:false
                                        SSDEEP:48:YwTn1Mfa1D2pGLBDRQWLE2FhAUJgT8SLNH8xLNGPBuXX+s:J2pGLrLE2LAEgFcU/s
                                        MD5:C0421A06171C4A314D7818D3247708E0
                                        SHA1:CD84E267D83EB08C2E0BC46348EA6784A34DDF1A
                                        SHA-256:D7054FEE1F3829EFCFAC4C3AC6D2A8607595946F0DADA3C3B51193ADE6F5A031
                                        SHA-512:459A013A6263C97F0B92D1ACD7D7B1A635A972B310940D58B79DA7949E964648127DD6861202DBD0CF57B13DDEE42821BF3A0BC3D15B74E9E947B5BB28CDA273
                                        Malicious:false
                                        Preview:{"valueOut": 1.05472082, "vout": [{"spentIndex": 0, "spentHeight": 293754, "value": "1.05072082", "n": 0, "spentTxId": "b664fca5b225d3fc01d6f562488136adc4d563e52fdc639db8b6f50afaa5d736", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914486088128a2137cd53b81f3efe4c3d612b7a777f88ac", "addresses": ["17bhHwY6nhomv4RxwkEGRZ6VutKjoGMDSS"], "asm": "OP_DUP OP_HASH160 486088128a2137cd53b81f3efe4c3d612b7a777f OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 293786, "value": "0.00400000", "n": 1, "spentTxId": "8cc1f4adf7224ce855cf535a5104594a0004cb3b640d6714fdb00b9128832dd5", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["14LmW5k4ssUrtbAB4255zdqv3b4w1TuX9e"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000000000092268fe69290d4150455aee141bfa0271c6948d18e56dfd0", "valueIn": 1.05482082, "fees": 0.0001, "vin": [{"addr": "13vPZWiYyXxX2MWZrzy

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_58497a7757224d1ff1941488d23087071103e5bf855f4c1c44e5c8d9d82ca46e.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1998
                                        Entropy (8bit):5.213712896268691
                                        Encrypted:false
                                        SSDEEP:24:YR62JiN2955h62ZTRNUWvWNX5yWH2ZBGlSvnOM8VWFGSK33Ppp5zFGSK33PWpvwi:Y82xJM2uW+NHH2GlSvOMi3y3kwEKYR
                                        MD5:0E420F80A7AAA938C9C95F134B485895
                                        SHA1:7522B9EE7E771C0E4D5DAC73B3B07DB4A2E2FB51
                                        SHA-256:B75930609237AA206CEEDA5952634B070141064A2B5FBAAB8E52B361713492F8
                                        SHA-512:B7B30F0A737A722C24E1D5E5E34A69D53BF6526B0198A0AE3E16A6B24C9E91FE12FBC4112CF17CE07E067E40B024410BD3396BE0A37D03B48FE2059FA6ABE318
                                        Malicious:false
                                        Preview:{"valueOut": 0.46995, "vout": [{"spentIndex": 28, "spentHeight": 288729, "value": "0.46885000", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91459581dcaf8ed947343b569f1fa2d855d0fc6d9bf88ac", "addresses": ["199QhWMtYE79AG3547QXmZpa8NtLDgme16"], "asm": "OP_DUP OP_HASH160 59581dcaf8ed947343b569f1fa2d855d0fc6d9bf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 1, "spentHeight": 284865, "value": "0.00110000", "n": 1, "spentTxId": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9142db345c36563122e2fd0f5485fb7ea9bbf7cb5a288ac", "addresses": ["15AeAhtNJNKyowK8qPHwgpXkhsokzLtUpG"], "asm": "OP_DUP OP_HASH160 2db345c36563122e2fd0f5485fb7ea9bbf7cb5a2 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000009ea3d77854af7c8cc0f28506dc8379c89830e445d951f4bf", "valueIn": 0.47005, "fees": 0.0001, "vin": [{"addr": "19UC6mkNJyqy3iKwQQyNm4TV

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_6189e3febb5a21cee8b725aa1ef04ffce7e609448446d3a8d6f483c634ef5315.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1854
                                        Entropy (8bit):5.21621821650514
                                        Encrypted:false
                                        SSDEEP:48:YXf79GCXMXK2pT1wl+yvQOlW54b/JQnirJQqilg+i:OzD2OXvQOlW8GnKGqLd
                                        MD5:FD28F430B4946788FBACBC0B8050DB87
                                        SHA1:1328B32D8004E8AD224B92DA62DEF56678C9D806
                                        SHA-256:874B05A1E78CF372E731F8B489FD3ABC1604C52B65B188B8DB7D9643111B9DE9
                                        SHA-512:29435858975967089E642D1248F392B05D098A68BA288ADF69C22AB20BA6160CB5D9FF0EFFE9D3320038909920FAEE4F5FE689F932393CCB4E6258BD98B3FA9D
                                        Malicious:false
                                        Preview:{"valueOut": 1.26511535, "vout": [{"spentIndex": 0, "spentHeight": 335022, "value": "1.26491535", "n": 0, "spentTxId": "79f47b5812eb8bcf13d4e60792129488ea237f86386468391d3ad3f8fdb3356e", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91495783804d28e528fbc4b48c7700471e6845804eb88ac", "addresses": ["1EdKhXv7zjGowPzgDQ4z1wa2ukVrXRXXkP"], "asm": "OP_DUP OP_HASH160 95783804d28e528fbc4b48c7700471e6845804eb OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 333744, "value": "0.00020000", "n": 1, "spentTxId": "dd320786d1f58c095be0509dc56b277b6de8f2fb5517f519c6e6708414e3300b", "scriptPubKey": {"type": "scripthash", "hex": "a914fb0670971091da8248b5c900c6515727a20e866287", "addresses": ["3QaKF8zobqcqY8aS6nxCD5ZYdiRfL3RCmU"], "asm": "OP_HASH160 fb0670971091da8248b5c900c6515727a20e8662 OP_EQUAL"}}], "blockhash": "0000000000000000149287bdefeecd34a7d0770ec5954f337c508bc07f980819", "valueIn": 1.26521535, "fees": 0.0001, "vin": [{"addr": "1AZjQHKxsUFQRR24qYTBAxMsQR9bgoRL4h", "vout": 0,

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_a6e2829d089cee47e481b1a753a53081b40738cc87e38f1d9b23ab57d9ad4396.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1787
                                        Entropy (8bit):5.206869121530489
                                        Encrypted:false
                                        SSDEEP:48:YfCcNQAD3mS7QAUCXBy2OhGumD9NFJ9Ns4Y3OQ:S7mSUCg2Ok9ud3b
                                        MD5:2028EEFB1A798FBBF132480119395695
                                        SHA1:DB4B4CE9BB82F8E40187EA40C759B7725EA4E8F6
                                        SHA-256:1FDE8C1724C5E83BF591F8DD756CDFCC08776CF99B72295981AA59A769AE998B
                                        SHA-512:A6635C52AC9CD0C3A4C8122B407FE442C2BB6E4D1C3B76BE95C12AD473B207002ADCF08AB96D1B184D94D89C3FBD4E3D7603E55C1BE4F8DD2A4A3B0E069BDC39
                                        Malicious:false
                                        Preview:{"valueOut": 0.02262478, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a914fe5b12d8eb22356e3e071ba80dabdf7272c1898787", "addresses": ["3QsvfB6d1LzYcpm8xyhS1N1HBRrzHTgLHB"], "asm": "OP_HASH160 fe5b12d8eb22356e3e071ba80dabdf7272c18987 OP_EQUAL"}}, {"spentIndex": 0, "spentHeight": 335144, "value": "0.02162478", "n": 1, "spentTxId": "e4bc1ae5e5007a08f2b3926fe11c66612e8f73c6b00c69c7027213b84d259be3", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914c3ddd5e35f9bbecd7b10f47b5734dbfe40e331cb88ac", "addresses": ["1JreWorDp4fm2tqPR9ntUXApyXUZPR7LSP"], "asm": "OP_DUP OP_HASH160 c3ddd5e35f9bbecd7b10f47b5734dbfe40e331cb OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000000000000f2c3875e9e7998fee70fe9d3961900230fafa55201d375", "valueIn": 0.02272478, "fees": 0.0001, "vin": [{"addr": "1QFYUD8963xdqEQ1PU64t8391t148qQtbS", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.0

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_c6091adf4c0c23982a35899a6e58ae11e703eacd7954f588ed4b9cdefc4dba52.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1831
                                        Entropy (8bit):5.194246236233287
                                        Encrypted:false
                                        SSDEEP:24:YtB5NPJTIq8r5sJTw2ZgZU1Tjsux3ED1TT47kKO3T0xfEzMqYgkep1ePGVBFp1eb:Y7JKuJw2aClLGD67xKTifkMqYQYwYJ3p
                                        MD5:60822ADFD8B26584C216E0B57D02152A
                                        SHA1:1D91ECCFD1994C0F29A32EB880B347029F0B2F6E
                                        SHA-256:38DADFD3BEDA94B678DDE0C93A1B56606C3ADA14EABAC1B9A19F46A40A7EBCA5
                                        SHA-512:A72F514E8E792ED6F5CD2F629D044417457B1F9E5C3772636086827695E669871885BEE4158C5FF2AEF84054C4CAE9D2AF5FA55B7145780BF11BB4975FE004FC
                                        Malicious:false
                                        Preview:{"valueOut": 0.0999, "vout": [{"spentIndex": 1, "spentHeight": 311327, "value": "0.09890000", "n": 0, "spentTxId": "e8d445189c4158fb01f19514015f85dccc09a680be969f7a26fe74aabbc989f7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9146970a648bb72eedba08c2d72eb47b8b704bf5ae388ac", "addresses": ["1AcWuArjpaRJBSYM8LpLk7mgcpEMbGxUNz"], "asm": "OP_DUP OP_HASH160 6970a648bb72eedba08c2d72eb47b8b704bf5ae3 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 332795, "value": "0.00100000", "n": 1, "spentTxId": "8382a2b2e3ec8788800c1d46d285dfa9dd4051edddd75982fad166b9273e5ac6", "scriptPubKey": {"type": "scripthash", "hex": "a91488376dc8232dbafd959cba5b370be6629506cb1c87", "addresses": ["3E7GDtuHqnqPmDgwH59pVC7AvySiSkbibz"], "asm": "OP_HASH160 88376dc8232dbafd959cba5b370be6629506cb1c OP_EQUAL"}}], "blockhash": "00000000000000000e72b8fdd326aed038bc1e9ed80cdaf2732d62cd10dd2c4d", "valueIn": 0.1, "fees": 0.0001, "vin": [{"addr": "1En8Z9ekdEzdu5gur5f1G9gowv42tbBaSD", "vout": 0, "sequence":

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2568
                                        Entropy (8bit):5.1658800730640015
                                        Encrypted:false
                                        SSDEEP:48:Ygt292C092mphYrJ2ha+hVPgkF4ARFnvtwEdmB+PBWl:A92C092mpUJ2M+hVISznvtwEI
                                        MD5:3B83F921459615780A63F1E07150C1A7
                                        SHA1:916055E6027D0AA44042086532FB8C4CC0559FE5
                                        SHA-256:599B1DEF3542DE5F11EE1AAFF8E4216B9576EF24B37B62D13031A6078DCB1C88
                                        SHA-512:7226438B28DB2C1AEE0B47B5D6158E649B337905DE8CCEF264E7C88A8F912F70002E81CEBE70E865719CC5BB740FC172DF77654E7E77E7C063AA6EDC0CCD1738
                                        Malicious:false
                                        Preview:{"valueOut": 0.002, "vout": [{"spentIndex": 29, "spentHeight": 288729, "value": "0.00100000", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9142f4490d5263906e4887ca2996b9e207af3e7824088ac", "addresses": ["15Jvu3nZNP7u2ipw2533Q9VVgEu2Lu9F2B"], "asm": "OP_DUP OP_HASH160 2f4490d5263906e4887ca2996b9e207af3e78240 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 284875, "value": "0.00100000", "n": 1, "spentTxId": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914812c13d97f9159e54e326b481b8f88a73df8507a88ac", "addresses": ["1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5"], "asm": "OP_DUP OP_HASH160 812c13d97f9159e54e326b481b8f88a73df8507a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000ad1b23698d40235f4bc71eb1ab6fa5891ade1fd89b0beb7e", "valueIn": 0.0021, "fees": 0.0001, "vin": [{"addr": "1CK7SJdcb8z9HuvVft3D91HLpLC

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_c6be22d34946593bcad1d2b013e12f74159e69574ffea21581dad115572e031c.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2008
                                        Entropy (8bit):5.193549517983418
                                        Encrypted:false
                                        SSDEEP:24:YWyo2JiN2955h62ZXN+IMhM5fx2ZBXcVgEHFayv1y0bTWp4KussfKTZsZ0QWJz8f:Y1o2xJM2G1hcx2MVHZoUjiBI
                                        MD5:D188B0D2FF9211CCC4ECA7E71E5BAF42
                                        SHA1:712DAF368594E91D37B826A419BCED128352F710
                                        SHA-256:808BB5D61CF08DB14EEE5CF3E239288626E17D4DEA1D9DB6A33B2F511D211C03
                                        SHA-512:EC8DC6F46A62E987F2575F2F83B61D80544CA95C59562C0839931328695D6E5A4CF115CECE8E6A6FD2E649D18CBFD815A3FE32763CCC5A03860FEAB36AC19980
                                        Malicious:false
                                        Preview:{"valueOut": 3.33165406, "vout": [{"spentIndex": 27, "spentHeight": 288729, "value": "3.33065406", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91459581dcaf8ed947343b569f1fa2d855d0fc6d9bf88ac", "addresses": ["199QhWMtYE79AG3547QXmZpa8NtLDgme16"], "asm": "OP_DUP OP_HASH160 59581dcaf8ed947343b569f1fa2d855d0fc6d9bf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 284865, "value": "0.00100000", "n": 1, "spentTxId": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9140223b1a09138753c9cb0baf95a0a62c82711567a88ac", "addresses": ["1CK7SJdcb8z9HuvVft3D91HLpLC6KSsGb"], "asm": "OP_DUP OP_HASH160 0223b1a09138753c9cb0baf95a0a62c82711567a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000371eecb3a4a9e2347cd8971b9a50a63ef2a7276c3a5e2ca7", "valueIn": 3.33175406, "fees": 0.0001, "vin": [{"addr": "1FSAF2vZ47XnyiF7Cuv

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_d1d08ea63255af4ad16b098e9885a252632086fa6be53301521d05253ce8a73d.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1789
                                        Entropy (8bit):5.2160500955448965
                                        Encrypted:false
                                        SSDEEP:48:Y/Cs85vJ8KA8L/6wV2U6QmBPjG276B27qpmGq:Ayv2U6RtG276B270pq
                                        MD5:AA428BE2A80833808F900139E530DC29
                                        SHA1:E4412293335DC34BC09A05D888B29A93E26B300F
                                        SHA-256:44BF0492F732F96A439A7FE16685437A28FB53846826268356E40A192695ED78
                                        SHA-512:2CFE453D093D23C90543348A4C59C06542051D28EFDD324DA8838C840376621317B327089D8553D7F0F4B97FE8A6D7251170A4119EF35D26EF664093F861FE9D
                                        Malicious:false
                                        Preview:{"valueOut": 0.1877507, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a914a4efc33d43d7a8a0040182c76ab624ff862f50d287", "addresses": ["3Gj7y1FdTppx2JEDqYqAEZFnKCA4GRysKF"], "asm": "OP_HASH160 a4efc33d43d7a8a0040182c76ab624ff862f50d2 OP_EQUAL"}}, {"spentIndex": 0, "spentHeight": 337674, "value": "0.18675070", "n": 1, "spentTxId": "1956152a945836ca835a04c0fbdbb1257bc9c24756f42c77dd1ed3c3fe1a94ac", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914167b282e46a22588d2746831f3dce2c37f6e70da88ac", "addresses": ["133sQKJfa4h55cwa5RcPAh5fmFA1SrELGJ"], "asm": "OP_DUP OP_HASH160 167b282e46a22588d2746831f3dce2c37f6e70da OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000177e78336482934c0f6826510464c5405490db118300dfab", "valueIn": 0.1878507, "fees": 0.0001, "vin": [{"addr": "12rApVsmCUHnPESfL3ycgTaQY7M6QrmY7j", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.187

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_d5f65ee80147b4bcc70b75e4bbf2d7382021b871bd8867ef8fa525ef50864882.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2411
                                        Entropy (8bit):5.015299557946149
                                        Encrypted:false
                                        SSDEEP:48:Y0/aLBDRQWLE28wpGgbQqn/WnUYv4AyYs4AFYR2+:x/aLrLE28wpZxn/Wn74AG4A+X
                                        MD5:7069970CC313514AB3C03ECA38FDA1CF
                                        SHA1:C923B27ED377C8CD2A60BDC55702BB3FF7AAF363
                                        SHA-256:04BE231FBC959B3454114650BA90CF8E073C085593BD686F8D316D6BA6785503
                                        SHA-512:8782DFDB02B19C0FF47E4746E6EBA44B404DFC6B66FBD56703C76A89D2EFE0B56BEC43B2CE072393F1BDAF1399A99A632F55F2432F0FD7F0C831C2960B35F516
                                        Malicious:false
                                        Preview:{"valueOut": 0.0039, "vout": [{"spentIndex": 0, "spentHeight": 280227, "value": "0.00390000", "n": 0, "spentTxId": "fd79435246dee76b2f159d2db08032d666c95adc544de64c8c49f474df4a7fee", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["14LmW5k4ssUrtbAB4255zdqv3b4w1TuX9e"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000011dec345ceae0765c98c72bdcb7cdd83e749ad37bbc3104cc", "valueIn": 0.004, "fees": 0.0001, "vin": [{"addr": "19qyPUSAXJ8cHw6TxZ6FYQFZdLMdJA7A2t", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.002, "n": 0, "valueSat": 200000, "txid": "c16a03f1cf8f99f6b5297ab614586cacec784c2d259af245909dedb0e39eddcf", "scriptSig": {"hex": "483045022072ba61305fe7cb542d142b8f3299a7b10f9ea61f6ffaab5dca8142601869d53c0221009a8027ed79eb3b9bc13577ac2853269323434558528c6b6a7e542be46e7e9a820141047a2d177c0f3626fc68c53610b0270fa6156181f4658

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_bitcoin_tx_e4bc1ae5e5007a08f2b3926fe11c66612e8f73c6b00c69c7027213b84d259be3.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1787
                                        Entropy (8bit):5.223993853654979
                                        Encrypted:false
                                        SSDEEP:48:Y2H2T1juY1D2eCeANE4ILoXqcY3DzpxNzfzpoNzhXB8Q:pHNS2ekE4ILo6x3ZxNzloNzhf
                                        MD5:06AEF6733A9DCB8F9ABA5E7410632DBF
                                        SHA1:3F8D8E8650CE3CE1C21DC66EB6C5424B916679A9
                                        SHA-256:EE0BEB9A223AA70E0DB4F62F8179B6549AF6CF0109F9BDD015A65F959FE3C9F6
                                        SHA-512:7A9A3F23BCA9E92E6CD6F75F00841FB130796C0FCA49F5097DC7C50FDCC515A19CD97C5D2BF0EBEF1CD9DA9264CDECB0FA3368CCD2909E4F3E853D2B401E3CF3
                                        Malicious:false
                                        Preview:{"valueOut": 0.02152478, "vout": [{"spentIndex": 0, "spentHeight": 338362, "value": "0.02052478", "n": 0, "spentTxId": "e8e0b3b3a10a5f7914abc7b6a0e6e6e35ec8944a81bb279701d5ce22c794d8fc", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914e6271f1394b1e25d976d0957cb2b36aeb1d875c588ac", "addresses": ["1MywHKjaict4ceqJ2SS414FtyfSgPDamn9"], "asm": "OP_DUP OP_HASH160 e6271f1394b1e25d976d0957cb2b36aeb1d875c5 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a9143e03a6446f27e2a0c1366b375a275c758e21edfa87", "addresses": ["37LvC1Q5CyKbMbKMncEJdXxqGhHxrBEgPE"], "asm": "OP_HASH160 3e03a6446f27e2a0c1366b375a275c758e21edfa OP_EQUAL"}}], "blockhash": "000000000000000000f2c3875e9e7998fee70fe9d3961900230fafa55201d375", "valueIn": 0.02162478, "fees": 0.0001, "vin": [{"addr": "1JreWorDp4fm2tqPR9ntUXApyXUZPR7LSP", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.0

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_decred_testnet_tx_16da185052740d85a630e79c140558215b64e26c500212b90e16b55d13ca06a8.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1829
                                        Entropy (8bit):5.236233983638887
                                        Encrypted:false
                                        SSDEEP:24:Y7MujMngzt8RE0jjFXCW3hKk9tDg+vy9hKk9tDg+qyLHrhBjpHjlZW5MGlklZW55:Y7jMFG0XcCOcC9HrLj7pL2sexyhxO
                                        MD5:ED5D45EDEAAD24BDF7A90176FCCF8DA8
                                        SHA1:8198BB76ADE2EE2D6D2AD33AD4F900C67F598DA7
                                        SHA-256:342673D54684E3F3BADCCAF59131E60C7935102F33F0D7C4D0E1321A07941241
                                        SHA-512:33905B9871F668267A41E072292799F63CFDA3B55E880E00329DAE3E20C978AE245AC550F5F067787F93102E2E651CECCB6CB4CA61F835784D359B6A8EF1C7EE
                                        Malicious:false
                                        Preview:{"txid": "16da185052740d85a630e79c140558215b64e26c500212b90e16b55d13ca06a8", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "157b2c4740d22f9c1ab6e21f267159e453abad418e5d686730c33d926978380c", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "5.71370733", "blockheight": 199736, "blockindex": 0, "scriptSig": {"asm": "3044022064b5d90720e600a30df2206456ab5d8dc8b15fb9ca368f459c8818163bc0811b0220337225cd791d137de24cf147c14ea3e24d627a894480a031f372291e2a7c802801 02c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b", "hex": "473044022064b5d90720e600a30df2206456ab5d8dc8b15fb9ca368f459c8818163bc0811b0220337225cd791d137de24cf147c14ea3e24d627a894480a031f372291e2a7c8028012102c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b"}, "n": 0, "addr": "TsexEoyMS79mFwmAJdi33X7n7dffG5J6wd5", "valueSat": 571370733, "value": "5.71370733", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 97, "unconfirmedInput": false}], "vout": [{"value": "2.0000000

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_decred_testnet_tx_3f7c395521d38387e7617565fe17628723ef6635a08537ad9c46cfb1619e4c3f.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1833
                                        Entropy (8bit):5.243253136344625
                                        Encrypted:false
                                        SSDEEP:48:YEw04vKUHwUHmHrCkjQ4NT2fttB9fcSyqNAg:pw04yVPHrzT2jcSyu
                                        MD5:F7C51D619E667AEB12DD9F1BD5EF368B
                                        SHA1:79630C379905F54E3C0E707DA4E079D2C4DC99D5
                                        SHA-256:7D66C40CFD86D268538ACBBAD7D58EE777425A4BD04B9B5513F48E0B92A03DC6
                                        SHA-512:7BEA3F57FFEC5B9620B7388E6FAABEAB8B29CD10913AB572BC1C4FD09395B6069457769D5EF090389E5C4F40BC4BB5A8B3B46D911C8E6A114A5A33BA55F95937
                                        Malicious:false
                                        Preview:{"txid": "3f7c395521d38387e7617565fe17628723ef6635a08537ad9c46cfb1619e4c3f", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "0e12c16e0e18eab7b14c28f8273588803fad511aaad3c24d5cdc5a2e5556bc05", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "3.42822438", "blockheight": 199752, "blockindex": 0, "scriptSig": {"asm": "3045022100ee07ae6d21a13fbc151e3d5381eaafd1976315020e68676d664ccedea38c78740220396dd0de4f8fd905bb1c944f39ff3af97479a5cb834fa7776680eb264fae749501 02c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b", "hex": "483045022100ee07ae6d21a13fbc151e3d5381eaafd1976315020e68676d664ccedea38c78740220396dd0de4f8fd905bb1c944f39ff3af97479a5cb834fa7776680eb264fae7495012102c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b"}, "n": 0, "addr": "TsexEoyMS79mFwmAJdi33X7n7dffG5J6wd5", "valueSat": 342822438, "value": "3.42822438", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 81, "unconfirmedInput": false}], "vout": [{"value": "1.427

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_decred_testnet_tx_5e6e3500a333c53c02f523db5f1a9b17538a8850b4c2c24ecb9b7ba48059b970.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1509
                                        Entropy (8bit):5.195923662479774
                                        Encrypted:false
                                        SSDEEP:24:Y7MjOigzKcoUs0FyHCWuQVeAhIQVeAgsTLjfHJlZW5L1aa2Zbl1a9NaTDcivITrn:Y5oUs0oY2e2/jIsa2Xs8vWrn
                                        MD5:2577CB1026B83A2D8D4EB11ABA94D088
                                        SHA1:3552312252FC0F8E5CAA7461BB383B78EE99E6EF
                                        SHA-256:5949881A3EB54D1900FD28F2B240C2A18C205732894A3680E96F1E382805C606
                                        SHA-512:692CD45501866769F28ADA77EDCA07C20D953CD88418A573BA50041293BEADD8872A60465BBA34A099E6F4A5BF81981848A27CBD302A3B74D2C4A609B2B36D04
                                        Malicious:false
                                        Preview:{"txid": "5e6e3500a333c53c02f523db5f1a9b17538a8850b4c2c24ecb9b7ba48059b970", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed", "vout": 1, "tree": 0, "sequence": 4294967295, "amountin": 2, "blockheight": 192676, "blockindex": 1, "scriptSig": {"asm": "3045022100bad68486491e449a731513805c129201d7f65601d6f07c97fda0588453c97d22022013e9ef59657ae4f344ac4f0db2b7a23dbfcdb51ebeb85277146ac189e547d3f701 02f5a745afb96077c071e4d19911a5d3d024faa1314ee8688bc6eec39751d0818f", "hex": "483045022100bad68486491e449a731513805c129201d7f65601d6f07c97fda0588453c97d22022013e9ef59657ae4f344ac4f0db2b7a23dbfcdb51ebeb85277146ac189e547d3f7012102f5a745afb96077c071e4d19911a5d3d024faa1314ee8688bc6eec39751d0818f"}, "n": 0, "addr": "TscqTv1he8MZrV321SfRghw7LFBCJDKB3oz", "valueSat": 200000000, "value": 2, "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 6387, "unconfirmedInput": false}], "vout": [{"value": "1.90000000", "n": 0, "ver

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_decred_testnet_tx_ccf95b0fd220ef59ae2e5b17005a81e222758122682d522eff8ae1fcbc93bc74.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1865
                                        Entropy (8bit):5.276277826643442
                                        Encrypted:false
                                        SSDEEP:24:Y7MrEvgzBT+k6s0NfTXCWT21DFbKO21DFb1/5jzHRlZW5D2Z4pNL5lZW5L1aa2Zp:YOTd6s0b2xZKO2xZ1RjY2Nsa2Xsg4b+
                                        MD5:4EF2B9B53E792AB97E944F8B4DF670FC
                                        SHA1:CE9FE3E3170268C8B2ED8822F4F3B656F71DE5C9
                                        SHA-256:EEF6B907580DD294C7D306E0F007AB1C6AD25A6DD2462A271F247456486B1AD4
                                        SHA-512:FFFF8FF777EC90BF12AA715AE14AFB8D80F2195A3E38CE2F45A457C3F485F0B22922D4EE9EDCE989E20493F0502C1919960D23FEA06DCAAF29AEC6584B6DB6F5
                                        Malicious:false
                                        Preview:{"txid": "ccf95b0fd220ef59ae2e5b17005a81e222758122682d522eff8ae1fcbc93bc74", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "bcc56f8b646c787d505275a7ab174fb060b028dcc4469e9a4d8391224fe67515", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "4.86000277", "blockheight": 186396, "blockindex": 0, "scriptSig": {"asm": "304502210094eb39bdfaa3236cf211c8249cf82603c0b7275dc59dc7b27936806e20a063b90220691aa71e9a0ab246a1dc4568c0ad4b5202d35ed0639fe64da17085701303e21801 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "48304502210094eb39bdfaa3236cf211c8249cf82603c0b7275dc59dc7b27936806e20a063b90220691aa71e9a0ab246a1dc4568c0ad4b5202d35ed0639fe64da17085701303e218012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 486000277, "value": "4.86000277", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 12667, "unconfirmedInput": false}], "vout": [{"value": "2.

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_decred_testnet_tx_e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1974
                                        Entropy (8bit):5.264708001562207
                                        Encrypted:false
                                        SSDEEP:48:YZoUCHH04gwSl/DTl+6YBjD2Psa2Xsk+yxl:04n04gLtvYBH2Ea28k+gl
                                        MD5:D28F8311CF0183619DD027F5AAC9EC52
                                        SHA1:D6A7177F5CA8A68ADC7468709D464ADAA308CB4E
                                        SHA-256:C9673ACF611E0313967B014E89DCD4239EA71AA7C5519E8C7D31F076C4ABE25A
                                        SHA-512:BDDC227F1D7C56CC9B357E83DDC2419D6FCFD73C93C673AD2DE30738FD8CED67F7DCDF4E63D15B638E3264A8E229BED44D2FB9E0B502C24721E3289DCB6F83DA
                                        Malicious:false
                                        Preview:{"txid": "e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "21012b08c5077036460e8f75bbc57beb11d7bc30e7ad224ad5e67d15bd086500", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "3.53210301", "blockheight": 192566, "blockindex": 0, "scriptSig": {"asm": "304402207d127d59a44187952d9d0de94ad34a19dd9a84beb124fd8a3fb439c862544d3202206618f321385c30bda96fb01ce03f70a269d78a301c0b0c2e3e3689dfae3f473301 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "47304402207d127d59a44187952d9d0de94ad34a19dd9a84beb124fd8a3fb439c862544d3202206618f321385c30bda96fb01ce03f70a269d78a301c0b0c2e3e3689dfae3f4733012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 353210301, "value": "3.53210301", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 5745, "unconfirmedInput": false}], "vout": [{"value": "1.53185

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_decred_testnet_tx_f395ef3e72a831a766db15e7a38bc28025d4ee02234d68bdea2d8353b47a3113.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1860
                                        Entropy (8bit):5.289824419731842
                                        Encrypted:false
                                        SSDEEP:48:Y6uKZntSZC0ZYta7YtlxjwZ32/gO152kkAgRMSW/w:IOyC0Ie32/F52kkaw
                                        MD5:EABA0AD56C716EC4D1E9F30EE56080D7
                                        SHA1:34FB4806960061CBDA0252DB4394985FB927DC64
                                        SHA-256:BB3C477FA38134064C9E65609471742C91FD3D05FF331F6FC3EE5A601EB470F5
                                        SHA-512:AA0A01125337860345679DACD64400FE1EFF9B49A55CB386226F3538421867866C7AEA4FFC5C47924EE2C9327C1B115CEC6A58E1B9DB2A19F31F3C1572771CC6
                                        Malicious:false
                                        Preview:{"txid": "f395ef3e72a831a766db15e7a38bc28025d4ee02234d68bdea2d8353b47a3113", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "e1b86d7694cf3bf9c83188bdb380892b85cd82a31410b09e267a745caaab7715", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "6.18712631", "blockheight": 184001, "blockindex": 0, "scriptSig": {"asm": "304402205de1a5bd40d551f77cd2a60d58767f92baa265ec99808ad14afe571682498e9b022054d148cd29d287e3e22d700b99e6a30823a9584a5db5e4ba26f4e60f613b4cc901 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "47304402205de1a5bd40d551f77cd2a60d58767f92baa265ec99808ad14afe571682498e9b022054d148cd29d287e3e22d700b99e6a30823a9584a5db5e4ba26f4e60f613b4cc9012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 618712631, "value": "6.18712631", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 15062, "unconfirmedInput": false}], "vout": [{"value": "2.0000

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb079c99448a.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1397
                                        Entropy (8bit):5.147066625408129
                                        Encrypted:false
                                        SSDEEP:24:YrQa8lMkVU2er+9nQU2eLrGlM8v9T3cstX4L644LunOsWo8N+D+GUn:YMFMnwX6l/lT3fU0onQn
                                        MD5:BD3EDEA1C6869561288E5DD25DF0A607
                                        SHA1:EBBFF10AD7C8AB1DA951E5E56DED97ADB8C16876
                                        SHA-256:6274F1DE3BAAD47AAC48E0331DFDBF9A1BAA2EE19F31E2B9F0098A9ED76AF701
                                        SHA-512:2256BB34DADC1688B2DCB59C440B7E3CCE151EDB3934651CF3C114C46E446FF3986815AAC8A14CC4A54D71046C52FACFFA5DBEFD4B969BEDB08BE225B6AA52F4
                                        Malicious:false
                                        Preview:{"valueOut": 1.23445789, "vout": [{"spentIndex": 0, "spentHeight": 1063388, "value": "0.12300000", "n": 0, "spentTxId": "65b811d3eca0fe6915d9f2d77c86c5a7f19bf66b1b1253c2c51cb4ae5f0c017b", "scriptPubKey": {"hex": "00140099a7ecbd938ed1839f5f6bf6d50933c6db9d5c", "asm": "0 0099a7ecbd938ed1839f5f6bf6d50933c6db9d5c"}}, {"spentIndex": 0, "spentHeight": 1063500, "value": "1.11145789", "n": 1, "spentTxId": "0e480a97c7a545c85e101a2f13c9af0e115d43734e1448f0cac3e55fe8e7399d", "scriptPubKey": {"type": "scripthash", "hex": "a91458b53ea7f832e8f096e896b8713a8c6df0e892ca87", "addresses": ["2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX"], "asm": "OP_HASH160 58b53ea7f832e8f096e896b8713a8c6df0e892ca OP_EQUAL"}}], "blockhash": "00000000c55ba0613303aa56e7381aa03236cd7f2ab63eb4b8ff4658f8ec2180", "valueIn": 1.23456789, "fees": 0.00011, "vin": [{"addr": "2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 1.23456789, "n": 0, "valueSat": 123456789, "txid": "20912f98e

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1792
                                        Entropy (8bit):5.224493432883447
                                        Encrypted:false
                                        SSDEEP:48:Y7B6XI8WvbAWvaOI21AKnKcKSoWRcv0O4O0:QywA5OI21ASoWRO50
                                        MD5:940DBDBB4E50CF164288129B4D31ED2E
                                        SHA1:88F4B27B13D89002AF360DDAD6CC941D04E370F4
                                        SHA-256:3EE7A1479CEA97DF72A13D103EF4FFDD63795D9209470E8AEFE2E8A7B6F477BC
                                        SHA-512:3D77FADD3D4B75A0D453901946B2E102C99786CDA8A1CAC4CCA6498A7838CDE45409A908018D5D668BD5FE38D6F64C5547F4535225F3CCB6AFD9D5856696F187
                                        Malicious:false
                                        Preview:{"txid": "16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5", "version": 1, "locktime": 0, "vin": [{"txid": "3143f555a21753fbf3f095e27823122c4107393bb388aca736bd613e91192be4", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "483045022100a2d3237b16795b10b33c19651261f9b9d1f8a0143f87f749adcc84e3d0b8f38702205ab3f80431af41091a01c946586b68fc843c8341738656cea70e25b0d0be2c970121024e6f7ddfe8c050649c7d3291f07e188c3fe779fb71954f8d00eaf1eff9af958e", "asm": "3045022100a2d3237b16795b10b33c19651261f9b9d1f8a0143f87f749adcc84e3d0b8f38702205ab3f80431af41091a01c946586b68fc843c8341738656cea70e25b0d0be2c97[ALL] 024e6f7ddfe8c050649c7d3291f07e188c3fe779fb71954f8d00eaf1eff9af958e"}, "addr": "mso9GMbZncQ767FQhkuMK8n4L4uQxDTFAA", "valueSat": 277569531, "value": 2.77569531, "doubleSpentTxID": null}], "vout": [{"value": "2.27568531", "n": 0, "scriptPubKey": {"hex": "76a9140889daec397047b8c6cce0080ba6c5455b443a8188ac", "asm": "OP_DUP OP_HASH160 0889daec397047b8c6cce0080ba6c5455b443a8

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_20912f98ea3ed849042efed0fdac8cb4fc301961c5988cba56902d8ffb61c337.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1787
                                        Entropy (8bit):5.258847704506951
                                        Encrypted:false
                                        SSDEEP:24:YLOsWo7U2er+9nQU2eLUCdNUZTa53Zu2ZBGlMO31hwIc2ONikH2ciHbEA3HONikW:YL0oGwXUCUuo2Glt31vrEOr7J6I
                                        MD5:972B8FF01FF2E7B05A038B88C84B5F31
                                        SHA1:561249E73E72FC49D9E9BD8F74ACBDBE202A4438
                                        SHA-256:BE3B35BB3F3DB92F93D7D33EA5CFCB8353404B321493A0AEC859E417B76F57C8
                                        SHA-512:B5A1B5F2FD84E1FCBB2DFBF9FF87613D4257DB17DE7E0C215775E39D0A72CD32B0050AF6B2B00F2879CAA1D036B9F33EB9D0F742ADE4BEB18AD7F09C91CA7FFF
                                        Malicious:false
                                        Preview:{"valueOut": 9.88976097, "vout": [{"spentIndex": 0, "spentHeight": 1063386, "value": "1.23456789", "n": 0, "spentTxId": "09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb079c99448a", "scriptPubKey": {"type": "scripthash", "hex": "a91458b53ea7f832e8f096e896b8713a8c6df0e892ca87", "addresses": ["2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX"], "asm": "OP_HASH160 58b53ea7f832e8f096e896b8713a8c6df0e892ca OP_EQUAL"}}, {"spentIndex": null, "spentHeight": null, "value": "8.65519308", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b84bacdcd8f4cc59274a5bfb73f804ca10f7fd1488ac", "addresses": ["mxKRHMmxvjY7RmZR4CJXPfGWpF6cMQEiM5"], "asm": "OP_DUP OP_HASH160 b84bacdcd8f4cc59274a5bfb73f804ca10f7fd14 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000c55ba0613303aa56e7381aa03236cd7f2ab63eb4b8ff4658f8ec2180", "valueIn": 9.8899, "fees": 0.00013903, "vin": [{"addr": "n173UNnYvJQ7tZFNmQqgchKgSZY5scpxNw", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 9

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):980
                                        Entropy (8bit):5.166168212444558
                                        Encrypted:false
                                        SSDEEP:24:YlTJv/XeqACegmlVoNT7L+F+F8T7L4AnTcFxVQY9F07SsZ+eS8Mo:Ylsaf8kAnT0VQY9F+1keF
                                        MD5:9820B34134E0FF9E5E147554CB00952A
                                        SHA1:EFE8DD0C1F64D271990BDEFA14132150D363F5DC
                                        SHA-256:437B0B9FC14A0080411BD971C8E26E8D845202C70BD9253BA6EDD3D977AFA47C
                                        SHA-512:0E7EB0A6B9F7345E6689C597EDFCDC34E38A7588E051226E14BC55D4868D8AACA6485392534D57ADBDF63FC36BEA7DE0EB3543684B259ABAB56CC92C245F3D72
                                        Malicious:false
                                        Preview:{"valueOut": 0.01603, "vout": [{"spentIndex": 0, "spentHeight": 1112864, "value": "0.01603000", "n": 0, "spentTxId": "c0bf56060a109624b4635222696d94a7d533cacea1b3f8245417a4348c045829", "scriptPubKey": {"type": "scripthash", "hex": "a914a8655acf68f785125561158b0f4db9b5d004404787", "addresses": ["2N8bcvm7XKX64fXnwRErbH4jgZSfBvQAzQp"], "asm": "OP_HASH160 a8655acf68f785125561158b0f4db9b5d0044047 OP_EQUAL"}}], "blockhash": "0000000000004cfcd096863f3f9a749907c0cc160446e17cdae2863735ba2fe9", "valueIn": 0.01604, "fees": 1e-05, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01604, "n": 0, "valueSat": 1604000, "txid": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "scriptSig": {"hex": "", "asm": null}}], "txid": "31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5", "blocktime": 1490794732, "version": 1, "confirmations": 8736, "time": 1490794732, "blockheight": 1112862, "locktime": 0, "size": 83}

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_65b811d3eca0fe6915d9f2d77c86c5a7f19bf66b1b1253c2c51cb4ae5f0c017b.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1262
                                        Entropy (8bit):5.118529297121093
                                        Encrypted:false
                                        SSDEEP:24:Y/WE2vieeAtd5MkE4L6Wk4LuJR7W+FYnOsWouy2m+lfwn:Y/Wh6eeid5MYV+Yn0otEdm
                                        MD5:5C5A07233E3130B0D93A706CB488BD33
                                        SHA1:21100F4D3E39CB0B45F2669772FAD7673C286547
                                        SHA-256:520BC64480F16E4F59676068A09ED33A21CD3BD6BA78089B648FCAC9AA6E95F0
                                        SHA-512:3ECCD89548DE5035983637DEBC6E608B6D581C0601C8062835DCBA5577AD4BD573850709C1354B4EF58B67A9FD95481B853A6ECF41D847D6844C15B9FCE2C2B9
                                        Malicious:false
                                        Preview:{"valueOut": 0.12289, "vout": [{"spentIndex": 0, "spentHeight": 1117152, "value": "0.05000000", "n": 0, "spentTxId": "0003c7cd0951f40acb2b7d9de20f87730971f9c6378012c8d3f94a0b56c57ab3", "scriptPubKey": {"type": "scripthash", "hex": "a9147a55d61848e77ca266e79a39bfc85c580a6426c987", "addresses": ["2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp"], "asm": "OP_HASH160 7a55d61848e77ca266e79a39bfc85c580a6426c9 OP_EQUAL"}}, {"spentIndex": 1, "spentHeight": 1063500, "value": "0.07289000", "n": 1, "spentTxId": "0e480a97c7a545c85e101a2f13c9af0e115d43734e1448f0cac3e55fe8e7399d", "scriptPubKey": {"hex": "0014d16b8c0680c61fc6ed2e407455715055e41052f5", "asm": "0 d16b8c0680c61fc6ed2e407455715055e41052f5"}}], "blockhash": "000000005e99726b20f3909411cef2d67f7fe489e53df5ebb1358671076bebfa", "valueIn": 0.123, "fees": 0.00011, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.123, "n": 0, "valueSat": 12300000, "txid": "09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb07

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_6f90f3c7cbec2258b0971056ef3fe34128dbde30daa9c0639a898f9977299d54.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):2515
                                        Entropy (8bit):5.18341209273868
                                        Encrypted:false
                                        SSDEEP:48:Yn7WOeT2SCAL6wLE26Yp6ZEHHEozPwvBEozPwvJmqlwEXwp0C:VT2SpL6wLE26esqzI5zIRtC
                                        MD5:15007251A08EFD6CB491ECC76ADC55EC
                                        SHA1:24A10071A74DF07044F2146DF416CF625C1C728D
                                        SHA-256:532AF35EE11DBBEC87FB94D810FB8D50CDA6F2BEC40DD09C925A297C8F2645C6
                                        SHA-512:A13FA6793EDDEDFC472596DE4A3C4A5C7EC76CF16FA966C81E0467C1F06B1BF0BE3446B1BF9E6E1C342DD07789D7D584583C2F3F33B5B69CB8739EDC71297A3D
                                        Malicious:false
                                        Preview:{"valueOut": 14.03850989, "vout": [{"spentIndex": 0, "spentHeight": 203911, "value": "4.03850989", "n": 0, "spentTxId": "5170fe1f25a05e1c9e125c27cd09e11f7c79c41409bc5b68f0e6f056af2d56b0", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914f5a05c2664b40d3116b1c5086c9ba38ed15b742e88ac", "addresses": ["n3uhx4JymCrWKX3e9i59YdJivMghF1bKZ4"], "asm": "OP_DUP OP_HASH160 f5a05c2664b40d3116b1c5086c9ba38ed15b742e OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "10.00000000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["mirio8q3gtv7fhdnmb3TpZ4EuafdzSs7zL"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000006656e1d72a211b7f469dd85209ba85c54127957a95591712a63d3848", "valueIn": 14.03850989, "fees": 0, "vin": [{"addr": "mnsfHtywp6AVUzgqu9P4tay6iQYY3WhCpz", "vout": 1, "sequence": 4294967295, "doubleSpe

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_9c31922be756c06d02167656465c8dc83bb553bf386a3f478ae65b5c021002be.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1790
                                        Entropy (8bit):5.233079132851722
                                        Encrypted:false
                                        SSDEEP:48:YGQCf89Y2AHGKx95XDf2TwlTjc1jNPljFHV:wG8y2AHGKL5XDuTwFjc1jNdZV
                                        MD5:59C0DCA43DE4E6AD2B2BB3C8B3BD4FD4
                                        SHA1:25953C37DAB5FCF2B3C305A74EB3ECE4CD7A0F18
                                        SHA-256:D1458AAABA4D8CBFA3850A8639CF9F11C786A6062971478EF694AD9E63DB4D24
                                        SHA-512:D2D80AC4C628A0DFC37E8E73F2AEAF19B7AF4C57681292C3AF96B5368FB130808FA1D58F77F22ABED8F5D5BAB17758965F73C22458CB8D5E3EE4C2BAD3C3EDF9
                                        Malicious:false
                                        Preview:{"valueOut": 0.135346, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.11924164", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b6fc54e2f7c490ba20c686f532bfb02230656dbf88ac", "addresses": ["mxCVZGoYAmscorbmaaPjRHrRUMHihGmex5"], "asm": "OP_DUP OP_HASH160 b6fc54e2f7c490ba20c686f532bfb02230656dbf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 897194, "value": "0.01610436", "n": 1, "spentTxId": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "scriptPubKey": {"type": "scripthash", "hex": "a91463ff81a0110ab929bd1d44befa32b081839bbece87", "addresses": ["2N2MxyAfifVhb3AMagisxaj3uij8bfXqf4Y"], "asm": "OP_HASH160 63ff81a0110ab929bd1d44befa32b081839bbece OP_EQUAL"}}], "blockhash": "00000000007a07f1fe23d089eddd6731fffd2696fed36611c5e0529e5e9c13b9", "valueIn": 0.13541492, "fees": 6.892e-05, "vin": [{"addr": "n1QPb8R2VWL6s2t5HbtDdNX3A7h4QTeCxB", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_b0946dc27ba308a749b11afecc2018980af18f79e89ad6b080b58220d856f739.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1726
                                        Entropy (8bit):5.256948371351805
                                        Encrypted:false
                                        SSDEEP:48:YSP3d0yQq83yGamVd0yQqV3yGASpGXBVWRT2h2KjZR0mnnyIfCC7:fPdR8emRVcSpGXBkR428ZR08yIh
                                        MD5:9B166C7909788282BF8D91BDF7FD996C
                                        SHA1:198048794F637317EC778086E7809919C113C8AF
                                        SHA-256:1B7A3CDA05CFA1B80D7078580E62F90C2378496C5CBC892302BE7FF88F7D946D
                                        SHA-512:AA4A786D41EC7CB4A93BDBCD932A1FFA4665EB560BD4346060949D80A383D5E9032D3FAD6C782032BAAD7D0FF97558900FC3DEA4952E18D4C6EA4EE14910684A
                                        Malicious:false
                                        Preview:{"txid": "b0946dc27ba308a749b11afecc2018980af18f79e89ad6b080b58220d856f739", "version": 1, "locktime": 0, "vin": [{"txid": "d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "473044022004b4045313f2b9f20c3d0d7e042c1caf3ee7af0531a4a4359c1f950f9b7780e602205abf837a2fdefd3ee708f052e740e763702bb40e976cab4e243035d4d77cb3b401210228fa17826fb9632c6e36ee31b32aebf20a81ee921b3d1c627a94b4b3dba879dd", "asm": "3044022004b4045313f2b9f20c3d0d7e042c1caf3ee7af0531a4a4359c1f950f9b7780e602205abf837a2fdefd3ee708f052e740e763702bb40e976cab4e243035d4d77cb3b4[ALL] 0228fa17826fb9632c6e36ee31b32aebf20a81ee921b3d1c627a94b4b3dba879dd"}, "addr": "mhu28zovdephvsYqdWicfYnCccTHwC3yfd", "valueSat": 193067531, "value": 1.93067531, "doubleSpentTxID": null}], "vout": [{"value": "0.55500000", "n": 0, "scriptPubKey": {"hex": "a9142880f749ea56a74031c2b222cf88937da6f58a3787", "asm": "OP_HASH160 2880f749ea56a74031c2b222cf88937da6f58a37 OP_EQUAL", "a

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):933
                                        Entropy (8bit):4.964094078069092
                                        Encrypted:false
                                        SSDEEP:24:YlT7LT4xVQY9FV4zN43XaRTfF+F8TrKNUnTu0+lwfmk:YlIVQY9FKG3AE8XKWnTilwp
                                        MD5:74AB61655D4803ACAD9335E38AC6E997
                                        SHA1:2DF647ABDDBBE59A686E6B342776DFAAD0C4A612
                                        SHA-256:264143AD4758F5532C828447A0AB9921897072FCB22A95D0DF4A80266A37EB1F
                                        SHA-512:C2D352D4A6E183D680EB54E71F2CADAE5D581BE4969746D7C5D6B96820DA3B02289E284F81C36121CB2C8ABCA0E15D304C868F758306EF5ACF59E41289FFF656
                                        Malicious:false
                                        Preview:{"valueOut": 0.01604, "vout": [{"spentIndex": 0, "spentHeight": 1112862, "value": "0.01604000", "n": 0, "spentTxId": "31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5", "scriptPubKey": {"hex": "00201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1", "asm": "0 1e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1"}}], "blockhash": "0000000000000056aebed3be65011aa622d7aecb8d1265f21f58734acce5915f", "valueIn": 0.01605, "fees": 1e-05, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01605, "n": 0, "valueSat": 1605000, "txid": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "scriptSig": {"hex": "", "asm": null}}], "txid": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "blocktime": 1467937587, "version": 1, "confirmations": 224391, "time": 1467937587, "blockheight": 897207, "locktime": 0, "size": 94}

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_d2dcdaf547ea7f57a713c607f15e883ddc4a98167ee2c43ed953c53cb5153e24.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1466
                                        Entropy (8bit):5.306569126167327
                                        Encrypted:false
                                        SSDEEP:24:Y7MZAPgE6uOX99/+YQByi89jiPUlP/dCgLKqOXG6c5hVty+2ZX19qIZ70eW00GzC:YUAubrZhpiP8PFCgWxW1J2dRx0TEJBG
                                        MD5:50257146388C4E586B2F15DBA10D47C8
                                        SHA1:EB22F05A3CECFDEB6F3B141C74D19009BD567A05
                                        SHA-256:012FD6590E8DDA29803E5655C3C52A94DBF18960B3B82AF916A67CBC773A1B14
                                        SHA-512:08932B2475372DBBE18947E8E09F6A2819C004E548342A05DBBF18D626469611E943963540D7E9B86A87B2AAC26C0AE2676D44C07C7023069F9135B354A12B37
                                        Malicious:false
                                        Preview:{"txid": "d2dcdaf547ea7f57a713c607f15e883ddc4a98167ee2c43ed953c53cb5153e24", "version": 1, "locktime": 0, "vin": [{"txid": "4e686d9815219fc2e57baae29c3b44567693b96fbe150550c269786fbbc6d653", "vout": 0, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "160014e31581ae69eca39192917940e6604fe6546441c0", "asm": "0014e31581ae69eca39192917940e6604fe6546441c0"}, "addr": "2N2Bw4ofaXx79bEdmG556FMGqa2EWmzJKr8", "valueSat": 2870562139, "value": 28.70562139, "doubleSpentTxID": null}], "vout": [{"value": "27.47158341", "n": 0, "scriptPubKey": {"hex": "a914f96f26251d4edd4c915aa76885dc0a91ec83df1087", "asm": "OP_HASH160 f96f26251d4edd4c915aa76885dc0a91ec83df10 OP_EQUAL", "addresses": ["2NFz7PpPg58HExT4stQDFoqpqduKaiwApqu"], "type": "scripthash"}, "spentTxId": "fe26bc077de27b72ffc5ce77a7e296c7c855b7deb3dec72a3f82c0c07c722bb0", "spentIndex": 0, "spentHeight": 1155197}, {"value": "1.23400000", "n": 1, "scriptPubKey": {"hex": "76a9145740ddea127387c6650ab531994fe6a29b0cec3388ac", "asm": "OP_DUP OP_HASH

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_d6da21677d7cca5f42fbc7631d062c9ae918a0254f7c6c22de8e8cb7fd5b8236.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):871
                                        Entropy (8bit):5.2418816855651995
                                        Encrypted:false
                                        SSDEEP:24:YYpsh5BYN+D45fx2ZBI3ovXWpSF1vFxvme+o9qzwJ4:Yp1Fkx2movpvMqIl
                                        MD5:721AC0A339013DD99590DD0E83B7B17C
                                        SHA1:347342B489BD47384B45580FEA5EBF31934D6431
                                        SHA-256:37644FAA0380D03A2FC1B52C3ECF601FF40383AB394C9670A9C747B6FB86F1CB
                                        SHA-512:38686F5639FC01118EE0C039CB447913308E38B7EECBCD2860D792C135FCAEB9B286EC9E97E6EBB0908A79E5243EE60932FD16D5BD21236781A801B65A09FBF4
                                        Malicious:false
                                        Preview:{"valueOut": 25.0027823, "isCoinBase": true, "vout": [{"spentIndex": 0, "spentHeight": 245746, "value": "25.00278230", "n": 0, "spentTxId": "871884776fe6aa078a16b66d82157ab4159257aa2889da9229f4e024ba40d6ee", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9140223b1a09138753c9cb0baf95a0a62c82711567a88ac", "addresses": ["mfiGQVPcRcaEvQPYDErR34DcCovtxYvUUV"], "asm": "OP_DUP OP_HASH160 0223b1a09138753c9cb0baf95a0a62c82711567a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000001994ec2997c267bc843d5b24032db26e5e1c56bffaf43c786a339", "vin": [{"coinbase": "0352bf03062f503253482f04f919855308f8000001c7000000092f7374726174756d2f", "n": 0, "sequence": 0}], "txid": "d6da21677d7cca5f42fbc7631d062c9ae918a0254f7c6c22de8e8cb7fd5b8236", "blocktime": 1401231865, "version": 1, "confirmations": 786738, "time": 1401231865, "blockheight": 245586, "locktime": 0, "size": 120}

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1792
                                        Entropy (8bit):5.222998041543106
                                        Encrypted:false
                                        SSDEEP:24:Y7MNAr1gE/G06RXlAxUQltAxUQzYFFl2kBsVqIAA5i2Z2j9qINWWJ2I+KgcmHncd:YVNB6veqYdaVRAJ24BDEUxbd
                                        MD5:2B9A19BC9A948F04ED95BF338D151BF0
                                        SHA1:C7C5C3D72D8C55E9EABFE4E309E08A48686C26EA
                                        SHA-256:68B0B150BA33ED7790D56257C135ED60D59F480AF7F587D9D53E9A23E257ABC0
                                        SHA-512:7C184E28F548BADBF32286308D50975EAE88EAA3748D0E43488E9852CC037B2196985F7AF6595838D2E93F9E6BB6FCD001800CDBF4AB42627928AE1E1C5CF4BA
                                        Malicious:false
                                        Preview:{"txid": "d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318", "version": 1, "locktime": 0, "vin": [{"txid": "16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5", "vout": 0, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "483045022100ea03d520495cd50b22b9c209f428de32aca2116c06e0fd391cf0a516a0974fff02207424a0742166fb4da9676fbfd09c8b5e7f73bdca72cd1088eb6037863448003d012102fbc883b74248b0207b22d42f591ba562db991494428adaaeb7c819ed3ac0cea9", "asm": "3045022100ea03d520495cd50b22b9c209f428de32aca2116c06e0fd391cf0a516a0974fff02207424a0742166fb4da9676fbfd09c8b5e7f73bdca72cd1088eb6037863448003d[ALL] 02fbc883b74248b0207b22d42f591ba562db991494428adaaeb7c819ed3ac0cea9"}, "addr": "mgJ6qw6qhWex1ePkbnaeTcSad7jca3Dpss", "valueSat": 227568531, "value": 2.27568531, "doubleSpentTxID": null}], "vout": [{"value": "0.34500000", "n": 0, "scriptPubKey": {"hex": "a914daa29c05a2af12752e459dedaee1d78e459c379c87", "asm": "OP_HASH160 daa29c05a2af12752e459dedaee1d78e459c379c OP_EQUAL"

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_e5040e1bc1ae7667ffb9e5248e90b2fb93cd9150234151ce90e14ab2f5933bcd.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1816
                                        Entropy (8bit):5.314516416564221
                                        Encrypted:false
                                        SSDEEP:48:YcLd8oCTRB2Y6aC8i2jo8PYDJT6wJgYjKc4H:TzM2Ovi2jo8PYD/gYjFM
                                        MD5:37E46A14D25F98EEF32FE14B837C67E9
                                        SHA1:67123509BAD10C39EE51179C8FC678843E606383
                                        SHA-256:83C93F48F2D8032F20210B95CE85BAE6B8D8934A0EE4D4ABD1848D30EAB368EF
                                        SHA-512:E085412803C4BFB1816F5E9B38C62A3C66DE3A980B2BA298696EDA4321A31D36E327538B770A4DA0710AEBFCB4D143A5596A791CC683331A5A043ADA74CC7385
                                        Malicious:false
                                        Preview:{"txid": "e5040e1bc1ae7667ffb9e5248e90b2fb93cd9150234151ce90e14ab2f5933bcd", "confirmations": 886416, "vout": [{"spentIndex": null, "spentHeight": null, "n": 0, "value": "0.31000000", "spentTxId": null, "scriptPubKey": {"addresses": ["mvbu1Gdy8SUjTenqerxUaZyYjmveZvt33q"], "asm": "OP_DUP OP_HASH160 a579388225827d9f2fe9014add644487808c695d OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914a579388225827d9f2fe9014add644487808c695d88ac", "type": "pubkeyhash"}}, {"spentIndex": null, "spentHeight": null, "n": 1, "value": "1.42920000", "spentTxId": null, "scriptPubKey": {"addresses": ["n1hLpUJwuAqRvhYDE3LH6VUEFJAMtTHp8e"], "asm": "OP_DUP OP_HASH160 dd597a4de23945b20a56446ce3a1b6e39cbf351c OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914dd597a4de23945b20a56446ce3a1b6e39cbf351c88ac", "type": "pubkeyhash"}}], "version": 1, "locktime": 0, "blockhash": "00000000204a06722dd65156b2c941ca4991246ad177f588c48999e50a2b0506", "valueIn": 1.7393, "valueOut": 1.7392, "blocktime": 1424379055, "fees": 0.0001, "time": 1424

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\safetlib\tests\txcache\insight_testnet_tx_f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228.json

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):1112
                                        Entropy (8bit):4.999595731548949
                                        Encrypted:false
                                        SSDEEP:24:YlTtnT+DpelDBZUCTEQ8TEaH8T4z343q1P+lEp3n:Yl5nTIYvx4Q8Qws3qYle
                                        MD5:6C6D1AC0BDF17A8E8C9292D15EE6EEC0
                                        SHA1:41E873D4C554DC72A37873E3B34A68B8A87686CB
                                        SHA-256:9109BD8F346990FB344E59B2EC5DD52BDA118978C169C93FB8FCBB780C913F1B
                                        SHA-512:34C9D7C5BEB5772C1AE7B33948FD2EF2624BD063C535B65C1E90366453FC49FCB588EA3C1C0B06EC4F80CEBBB85C91601219C2E7D214E3CEA06C66010C5374B3
                                        Malicious:false
                                        Preview:{"valueOut": 0.01605, "vout": [{"spentIndex": 0, "spentHeight": 897207, "value": "0.01605000", "n": 0, "spentTxId": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "scriptPubKey": {"hex": "0020c5f4a0a4ea7c0392efe0a9670a73264cffa90b19107cd8a8e9750ff93c77fdfb", "asm": "0 c5f4a0a4ea7c0392efe0a9670a73264cffa90b19107cd8a8e9750ff93c77fdfb"}}], "blockhash": "00000000000001813ec2fb42915573989417ce2bee539cafedf58294b3d69f43", "valueIn": 0.01610436, "fees": 5.436e-05, "vin": [{"addr": "2N2MxyAfifVhb3AMagisxaj3uij8bfXqf4Y", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01610436, "n": 0, "valueSat": 1610436, "txid": "9c31922be756c06d02167656465c8dc83bb553bf386a3f478ae65b5c021002be", "scriptSig": {"hex": "2200201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1", "asm": "00201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1"}}], "txid": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "blocktime": 146793075

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\select.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):27416
                                        Entropy (8bit):6.835600420682668
                                        Encrypted:false
                                        SSDEEP:768:+WFXERsAnq2NWow4VILQGR5YiSyvLPxWEa0P+:+xqwWow4VILQGf7SyzPx+
                                        MD5:6EBA3E39E61C839818F502BD67BBD672
                                        SHA1:CD724D843CA57F6EDBBBE94B3C352769F70AED65
                                        SHA-256:C942F16C17687E988434813E50D2FB222C528D0E56CCF2D15B13104676F93FC9
                                        SHA-512:8614F4DBF7DF68D66BA611B31135EB35EF5C6D24E1C3F3EC4E8DF67BE75102DA991F26FEA76EF930B686A1ED08AD4A4C5F62CB2BEA4233B26D276FFD3C54FC31
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5$..qE{.qE{.qE{.x=..sE{.#0z.sE{.#0~.zE{.#0..{E{.#0x.sE{..0z.sE{.qEz.LE{.:=z.tE{..0s.pE{..0{.pE{..0..pE{..0y.pE{.RichqE{.........PE..L...H.,d...........!........."...............0......................................u%....@..........................:..L....;..x....`...............<.../...p......D6..T............................6..@............0...............................text............................... ..`.rdata.."....0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\sqlite3.dll

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1196824
                                        Entropy (8bit):6.776326140308749
                                        Encrypted:false
                                        SSDEEP:24576:E6OOR2q+dGpg4XzLojJT5r6hKarVTgnEEUNTZOdEV8RpDq+m5:zR2L94Xo5Q5OEeEYDzm5
                                        MD5:C60F6C4051EB55350C6EEDF5A87016AA
                                        SHA1:DB1C31C12BE04A5785D7CA3B8EA91B290EE9D1D8
                                        SHA-256:376D80DB08CEC2C8873A4D5EBC7D83F50F26A43EBAA837020874C8586FD85975
                                        SHA-512:FCBDFC27A778B1084BE96B88CF438E0937ADB8BABC41B538892B76283232AA557CE46701A8F62AB2FDB208AB0933F0E473CBD6DAD59203DC7495F48EE289B2A3
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.............^....L.....L.....L.....L.....U.........................2..........Rich...................PE..L.....,d...........!................_........................................@.......7....@.........................`;..."...].........................../...........5..T........................... 6..@............................................text............................... ..`.rdata...Y.......Z..................@..@.data....'...p..."...Z..............@....rsrc................|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\_MEI42682\unicodedata.pyd

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                        Category:dropped
                                        Size (bytes):1114904
                                        Entropy (8bit):5.393522969186712
                                        Encrypted:false
                                        SSDEEP:12288:PAKqQCb5Pfhnzr0qlmL8klMmuZ63NGM7IRG5eeIDe6VZyrIBHdQLhfFE+tc9S:PAKsZV0mmduJMMREtIC6Vo4uLc9S
                                        MD5:73A25EF47977BFF82315023F7F8E9DB1
                                        SHA1:9BD7882C39A995EA4044FB5D562060C16AF9A023
                                        SHA-256:AC2966C1A1F1FBEE97666E0AAADE5AB960B445AF3BACC1650B83EA8B637F2F7A
                                        SHA-512:C6155957E37C7A690E815F78508CCDCE9036E2EFFE45A9B47EAAFBB8A091D661B808C1A2CC6C7B83B41752121B869A877C981EE346B790F3CF3900A3D6F0B198
                                        Malicious:false
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..p..p..p...p..p..q..p..q...p..q..p..q..p..q..p..q..p..p...p..q..p..q..p..tp..p..q..pRich..p........................PE..L...K.,d...........!.....8...........=.......P.......................................X....@.............................X................................/..............T...........................P...@............P..,............................text...J7.......8.................. ..`.rdata...}...P...~...<..............@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Roaming\Electrum\blockchain_headers

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):67576320
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3::
                                        MD5:687BAADADABCA3630EEDD8BB5106DFF0
                                        SHA1:1AA84844AE7692308555972934378C34091AD2B8
                                        SHA-256:6E93D6F509DCD1A99A4F51877CF8DA1D53ED3C7490B2B20D23F4C437A1B02F83
                                        SHA-512:433B645229EF7002FDE4763F99408C07705F671FF3D57102B1A04980F6F0CA0E7D7D48D29712963DCD9D7F3F281E9EEE30102C6DF583E069A5ACEA396DCED59D
                                        Malicious:true
                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Roaming\Electrum\config

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):252
                                        Entropy (8bit):4.953558155804927
                                        Encrypted:false
                                        SSDEEP:6:3FFBWLURhvFNGwApr9ApRZvFsheQV+AH6ZFQ7om9A:1bW+vdmA0hhV+AH6yoeA
                                        MD5:850935DC66F040D7C379995702E1F965
                                        SHA1:3389A105F98C951C17172C028D9469DA4747F97B
                                        SHA-256:EC84411C6FA45ECDCCE5701E91F1FBA138202C4BFCDF5DDD8DA381F975B57845
                                        SHA-512:D2EE0451801066681873EDEC5CCA92FEE6EB52C6B609D7A99061B10F54FC25B57DD683E8B3116B96357FC504B0B8B09A6016B4FB82A401AE4118C2DA4656B93E
                                        Malicious:true
                                        Preview:{.. "blockchain_preferred_block": {.. "hash": "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",.. "height": 0.. },.. "config_version": 3,.. "rpcpassword": "B2XC07tNOn6i-b9mbx73NA==",.. "rpcuser": "user"..}

                                        C:\Users\user\AppData\Roaming\Electrum\daemon

                                        Download File
                                        Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):49
                                        Entropy (8bit):3.9263617634376455
                                        Encrypted:false
                                        SSDEEP:3:RLVmL:nmL
                                        MD5:83BE173E604B31696642852192A2854C
                                        SHA1:0376582AD58E8D194EE836B3EA4807A84D4B28F2
                                        SHA-256:CB5A4247D3F30F222BDAE94C4919189F95A6CFC4F40EF10CCBEF0BE5146E7347
                                        SHA-512:7FF4162A8314B09567669D43D64AA442D929B9B5C0E0EA5317E9E9546D60813FA8A185C868D66E7644CD42EF2D15344D9476A068C3DF95CE74DC29EDF67AB1D9
                                        Malicious:false
                                        Preview:('tcp', ('127.0.0.1', 49715), 1725561526.0947702)

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                        Entropy (8bit):7.998115015420231
                                        TrID:
                                        • Win32 Executable (generic) a (10002005/4) 99.53%
                                        • InstallShield setup (43055/19) 0.43%
                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                        • DOS Executable Generic (2002/1) 0.02%
                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                        File name:SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        File size:47'764'104 bytes
                                        MD5:d430fb367b17fdd8a5f7fd72c16e0477
                                        SHA1:bd832259a3dd2e8d0c4e421bdf92c0a7b06f9049
                                        SHA256:3710df97f996f8f6390fa8b23bbafea03f2e7568bf00297f737324f380f06675
                                        SHA512:255c2888007b0236c70c74293995e23a78f921a6712abaffefccd4d4a85c5ce1a3d1d7e40e60fc3fcfc194c979e9d4497860f4572b75b16d8d55304bfc18652f
                                        SSDEEP:786432:MF8WWxUd9d1LRphkc3FphiWGlso5EYWAFPMUcgDB2hREoBdImGIcmdK1RdiG+udQ:MF8WWxU9ddRzFphiZd5EXUcgD4hAIzsY
                                        TLSH:8CA733C68DB20073F422057BACD5FDF1873E12E8AB76842BDA39045765BBCE1195263B
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n05[........../....#.j........................@..........................`.......C.....................................

                                        File Icon

                                        Icon Hash:2b2d33aaaa232d33

                                        Static PE Info

                                        General

                                        Entrypoint:0x4014b0
                                        Entrypoint Section:.text
                                        Digitally signed:true
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
                                        DLL Characteristics:
                                        Time Stamp:0x5B35306E [Thu Jun 28 19:01:02 2018 UTC]
                                        TLS Callbacks:0x40d830, 0x40d7e0
                                        CLR (.Net) Version:
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:e9d858bf5cc2b22933333fd98518c716

                                        Authenticode Signature

                                        Signature Valid:true
                                        Signature Issuer:CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, O=EnVers Group SIA, C=LV
                                        Signature Validation Error:The operation completed successfully
                                        Error Number:0
                                        Not Before, Not After
                                        • 08/05/2024 02:00:00 08/05/2025 01:59:59
                                        Subject Chain
                                        • CN=Electrum Technologies GmbH, O=Electrum Technologies GmbH, L=Berlin, S=Berlin, C=DE
                                        Version:3
                                        Thumbprint MD5:147702A38DDFCC9690E07814BB328522
                                        Thumbprint SHA-1:BFF7076B4C517AEE0E3D2CCAA7F894C2399010CF
                                        Thumbprint SHA-256:2FC8F7385221D01B0010390F40A0653A72CF36EFE729B8FF21FBF8F1C458385F
                                        Serial:0207B0D2256E682FD464B51556AD55A7

                                        Entrypoint Preview

                                        Instruction
                                        mov dword ptr [004302A8h], 00000001h
                                        jmp 00007FA1107BDD06h
                                        nop
                                        mov dword ptr [004302A8h], 00000000h
                                        jmp 00007FA1107BDCF6h
                                        nop
                                        sub esp, 1Ch
                                        mov eax, dword ptr [esp+20h]
                                        mov dword ptr [esp], eax
                                        call 00007FA1107D38F6h
                                        test eax, eax
                                        sete al
                                        add esp, 1Ch
                                        movzx eax, al
                                        neg eax
                                        ret
                                        nop
                                        nop
                                        nop
                                        push ebp
                                        mov ebp, esp
                                        push edi
                                        push esi
                                        push ebx
                                        sub esp, 1Ch
                                        mov dword ptr [esp], 00419000h
                                        call dword ptr [00431370h]
                                        sub esp, 04h
                                        test eax, eax
                                        je 00007FA1107BE0C5h
                                        mov ebx, eax
                                        mov dword ptr [esp], 00419000h
                                        call dword ptr [00431390h]
                                        mov edi, dword ptr [00431378h]
                                        sub esp, 04h
                                        mov dword ptr [00422028h], eax
                                        mov dword ptr [esp+04h], 00419013h
                                        mov dword ptr [esp], ebx
                                        call edi
                                        sub esp, 08h
                                        mov esi, eax
                                        mov dword ptr [esp+04h], 00419029h
                                        mov dword ptr [esp], ebx
                                        call edi
                                        mov dword ptr [00418004h], eax
                                        sub esp, 08h
                                        test esi, esi
                                        je 00007FA1107BE063h
                                        mov dword ptr [esp+04h], 0042202Ch
                                        mov dword ptr [esp], 0041F000h
                                        call esi
                                        mov dword ptr [esp], 004015A0h
                                        call 00007FA1107BDFB3h
                                        lea esp, dword ptr [ebp-0Ch]
                                        pop ebx
                                        pop esi

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x310000x10dc.idata
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x350000x10148.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x2d8aa680x2820
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x1d9e40x18.rdata
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x313040x278.idata
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x10000x168440x16a00bfa94cc0c6fba6cfbec218f12bae7497False0.49559737569060774data6.147093437333147IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .data0x180000x7c0x2005f248157483c9031b1f144a8f35a67cdFalse0.158203125data1.0951453424827384IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rdata0x190000x5ab80x5c00aacd1e7ef1965ac5f96b9f65821eebe5False0.4833984375data6.42318523882154IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
                                        /40x1f0000x282c0x2a005ade56e21c5cc0870eed26c14dc73992False0.31156994047619047data4.885403344130252IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
                                        .bss0x220000xecb40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .idata0x310000x10dc0x12001a0f376f0f1923d8b6ac09985cd92d62False0.3878038194444444PGP symmetric key encrypted data - Plaintext or unencrypted data5.130264530707902IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .CRT0x330000x340x2003d6d77b813b142a365114d8d26628b28False0.0703125Matlab v4 mat-file (little endian) \220\327@, numeric, rows 4198704, columns 00.2709192282599745IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .tls0x340000x80x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rsrc0x350000x110000x102003b12c52c6e1917222adab677428556b6False0.6228197674418605data6.0401874871081915IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_ICON0x352080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.38853790613718414
                                        RT_ICON0x35ab00x6d06PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9946255822285919
                                        RT_ICON0x3c7b80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 00.2696622579121398
                                        RT_ICON0x409e00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.34315352697095436
                                        RT_ICON0x42f880x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.38672607879924953
                                        RT_ICON0x440300x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.5866279069767442
                                        RT_ICON0x446e80x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.5328014184397163
                                        RT_GROUP_ICON0x44b500x68data0.7596153846153846
                                        RT_MANIFEST0x44bb80x590XML 1.0 document, ASCII text, with CRLF line terminators0.44662921348314605

                                        Imports

                                        DLLImport
                                        ADVAPI32.dllConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
                                        COMCTL32.DLLLoadIconMetric
                                        GDI32.dllCreateFontIndirectW, DeleteObject, SelectObject
                                        KERNEL32.dllCloseHandle, CreateDirectoryW, CreateProcessW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MulDiv, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte
                                        msvcrt.dll__argc, __lconv_init, __mb_cur_max, __p__commode, __p__fmode, __p__wcmdln, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _errno, _filelengthi64, _fileno, _findclose, _get_osfhandle, _initterm, _iob, _lock, _onexit, _setmode, _snwprintf, fwprintf, _unlock, _wcsdup, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wtempnam, abort, atoi, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputwc, fread, free, fsetpos, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, setbuf, setlocale, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy, wcstombs, _wstat, _wfindnext, _wfindfirst, _stat, _wcsdup, _strdup, _getpid, _fileno
                                        USER32.dllCreateWindowExW, DestroyIcon, DialogBoxIndirectParamW, DrawTextW, EndDialog, GetClientRect, GetDC, GetDialogBaseUnits, GetWindowLongW, InvalidateRect, MessageBoxA, MessageBoxW, MoveWindow, ReleaseDC, SendMessageW, SetWindowLongW, SystemParametersInfoW

                                        Network Behavior

                                        ⊘No network behavior found

                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:14:38:21
                                        Start date:05/09/2024
                                        Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
                                        Imagebase:0x400000
                                        File size:47'764'104 bytes
                                        MD5 hash:D430FB367B17FDD8A5F7FD72C16E0477
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:3
                                        Start time:14:38:38
                                        Start date:05/09/2024
                                        Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.24562.10289.exe"
                                        Imagebase:0x400000
                                        File size:47'764'104 bytes
                                        MD5 hash:D430FB367B17FDD8A5F7FD72C16E0477
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:4
                                        Start time:14:38:42
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                        Imagebase:0x790000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:14:38:42
                                        Start date:05/09/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:6
                                        Start time:14:38:43
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                        Imagebase:0x790000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:7
                                        Start time:14:38:43
                                        Start date:05/09/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:8
                                        Start time:14:38:45
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
                                        Imagebase:0x790000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:9
                                        Start time:14:38:45
                                        Start date:05/09/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:10
                                        Start time:14:38:45
                                        Start date:05/09/2024
                                        Path:C:\Windows\SysWOW64\fsutil.exe
                                        Wow64 process (32bit):true
                                        Commandline:fsutil sparse setflag "C:\Users\user\AppData\Roaming\Electrum\blockchain_headers" 1
                                        Imagebase:0x8f0000
                                        File size:167'440 bytes
                                        MD5 hash:452CA7574A1B2550CD9FF83DDBE87463
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:1.7%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:9.5%
                                          Total number of Nodes:1395
                                          Total number of Limit Nodes:36
                                          execution_graph 19701 404300 19702 40430b 19701->19702 19709 4042d0 19702->19709 19705 40436b 19708 4042d0 3 API calls 19708->19705 19732 40f100 19709->19732 19711 4042f7 19711->19705 19712 40e900 setlocale 19711->19712 19713 40e923 _strdup 19712->19713 19714 40e92d setlocale 19712->19714 19713->19714 19715 40e950 wcstombs realloc wcstombs setlocale free 19714->19715 19716 40e948 19714->19716 19718 404348 19715->19718 19716->19715 19717 40e9c8 mbstowcs 19716->19717 19748 40e630 19717->19748 19718->19708 19721 40ea42 19723 40ea6e 19721->19723 19725 40ea80 19721->19725 19722 40ea21 19722->19721 19724 40ec55 setlocale free 19722->19724 19723->19715 19724->19718 19726 40eae1 wcstombs realloc wcstombs 19725->19726 19731 40eb70 19725->19731 19728 40eb4e setlocale free 19726->19728 19728->19718 19729 40ec9b wcstombs 19729->19728 19730 40ecc2 19729->19730 19730->19728 19731->19729 19731->19731 19733 40f150 19732->19733 19734 40f119 19732->19734 19736 411040 3 API calls 19733->19736 19739 411040 _errno 19734->19739 19738 40f170 19736->19738 19738->19711 19741 4110e2 19739->19741 19743 40f138 19739->19743 19740 4111a0 fputc 19740->19741 19741->19740 19741->19743 19744 40f340 19741->19744 19743->19711 19745 40f350 19744->19745 19746 40f378 fputc 19745->19746 19747 40f35f 19745->19747 19746->19741 19747->19741 19749 40e63d mbstowcs 19748->19749 19749->19721 19749->19722 19750 407940 19751 40794e 19750->19751 19752 4079a7 GetTempPathW _getpid 19751->19752 19753 40795b 19751->19753 19786 4074c0 19752->19786 19808 407650 19753->19808 19756 4079e9 _wtempnam 19789 408d40 19756->19789 19757 407967 19817 4077c0 19757->19817 19761 40797a 19764 407984 _wputenv_s free 19761->19764 19765 407a8a 19761->19765 19762 407ab0 19857 408920 19762->19857 19763 407a08 free 19763->19756 19768 407a15 19763->19768 19764->19752 19766 407aa0 19764->19766 19852 402ed0 19766->19852 19768->19765 19774 407a50 19768->19774 19775 407a28 19768->19775 19772 407a42 19773 407ae7 19776 407b0c 19773->19776 19777 407aef 19773->19777 19839 408b00 19774->19839 19803 407700 19775->19803 19782 408b00 12 API calls 19776->19782 19780 407700 15 API calls 19777->19780 19784 407aff free 19780->19784 19781 407a3a free 19781->19772 19785 407b28 SetEnvironmentVariableW free 19782->19785 19784->19772 19785->19772 19869 40f180 19786->19869 19788 4074e7 19788->19756 19790 40e630 19789->19790 19791 408d4e GetCurrentProcess OpenProcessToken 19790->19791 19792 408e60 GetTokenInformation 19791->19792 19793 408d96 19791->19793 19795 408ea1 calloc 19792->19795 19796 408e92 GetLastError 19792->19796 19794 408d9c free 19793->19794 19797 408db9 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 19794->19797 19798 408dad FindCloseChangeNotification 19794->19798 19795->19793 19799 408ec3 GetTokenInformation 19795->19799 19796->19793 19796->19795 19800 407a00 19797->19800 19801 408e2c CreateDirectoryW 19797->19801 19798->19797 19799->19794 19802 408eeb ConvertSidToStringSidW 19799->19802 19800->19762 19800->19763 19801->19800 19802->19794 19804 408b00 12 API calls 19803->19804 19805 407722 19804->19805 19806 408b00 12 API calls 19805->19806 19807 407740 _wputenv_s free free 19806->19807 19807->19781 19809 40765b 19808->19809 19810 408b00 12 API calls 19809->19810 19811 407680 GetEnvironmentVariableW 19810->19811 19812 4076b0 ExpandEnvironmentStringsW 19811->19812 19813 40769c 19811->19813 19814 408920 15 API calls 19812->19814 19813->19757 19815 4076e7 19814->19815 19815->19813 19816 4076f0 _strdup 19815->19816 19816->19757 19818 4077ce 19817->19818 19819 408b00 12 API calls 19818->19819 19820 4077ef 19819->19820 19821 40790e 19820->19821 19822 4077f9 ExpandEnvironmentStringsW free 19820->19822 19821->19761 19825 402ed0 12 API calls 19821->19825 19823 407900 19822->19823 19824 407827 19822->19824 19826 402ed0 12 API calls 19823->19826 19904 408fa0 wcslen 19824->19904 19829 4078e2 19825->19829 19826->19821 19829->19761 19830 4078f0 _wcsdup 19832 407852 19830->19832 19831 407837 _wfullpath 19831->19832 19833 40785a wcschr 19832->19833 19834 40792e 19832->19834 19836 4078d2 CreateDirectoryW 19833->19836 19837 407888 19833->19837 19835 402ed0 12 API calls 19834->19835 19835->19829 19836->19829 19838 407890 wcsncpy CreateDirectoryW wcschr 19837->19838 19838->19836 19838->19838 19840 408b60 MultiByteToWideChar 19839->19840 19841 408b13 19839->19841 19842 408bf8 19840->19842 19843 408b9c calloc 19840->19843 19844 408b1d MultiByteToWideChar 19841->19844 19845 402f90 9 API calls 19842->19845 19843->19844 19846 408bb9 19843->19846 19847 408bd8 19844->19847 19848 407a6c SetEnvironmentVariableW free 19844->19848 19845->19848 19907 402f90 GetLastError 19846->19907 19849 402f90 9 API calls 19847->19849 19848->19765 19849->19848 19853 40f100 3 API calls 19852->19853 19854 402f01 19853->19854 19855 402df0 12 API calls 19854->19855 19856 402f19 19855->19856 19856->19772 19858 408990 WideCharToMultiByte 19857->19858 19859 408933 19857->19859 19861 408a38 19858->19861 19862 4089dc calloc 19858->19862 19860 40893d WideCharToMultiByte 19859->19860 19863 408a18 19860->19863 19868 407ad0 free 19860->19868 19865 402f90 12 API calls 19861->19865 19862->19860 19864 4089f9 19862->19864 19867 402f90 12 API calls 19863->19867 19866 402f90 12 API calls 19864->19866 19865->19868 19866->19868 19867->19868 19868->19772 19868->19773 19870 40f1d0 19869->19870 19871 40f199 19869->19871 19873 4137e0 7 API calls 19870->19873 19876 4137e0 _errno 19871->19876 19875 40f1f0 19873->19875 19875->19788 19878 413868 19876->19878 19885 40f1b8 19876->19885 19877 4138d0 19881 411e60 6 API calls 19877->19881 19883 4138f6 19877->19883 19878->19877 19879 413899 19878->19879 19879->19885 19886 411e60 19879->19886 19881->19883 19882 411e60 6 API calls 19884 4140f3 19882->19884 19883->19882 19883->19885 19884->19884 19885->19788 19887 411e74 19886->19887 19888 411f90 19887->19888 19889 411e93 19887->19889 19890 411fe3 fwprintf 19888->19890 19891 411f96 19888->19891 19897 411e97 19889->19897 19900 4119e0 19889->19900 19892 411ea2 19890->19892 19893 411fa7 fwprintf 19891->19893 19894 411ffd fwprintf 19891->19894 19892->19885 19893->19892 19894->19892 19896 411f40 19896->19892 19898 411f76 fputwc 19896->19898 19897->19892 19897->19896 19899 411eed fputwc 19897->19899 19898->19896 19899->19897 19901 4119f1 19900->19901 19902 411a00 19901->19902 19903 411a18 fputwc 19901->19903 19902->19889 19903->19889 19905 408fc8 iswctype 19904->19905 19906 40782f 19904->19906 19905->19906 19906->19830 19906->19831 19908 40f100 3 API calls 19907->19908 19909 402fcd 19908->19909 19916 4086f0 19909->19916 19911 402fd9 19928 402dc0 19911->19928 19915 40301c 19915->19848 19917 4086fb 19916->19917 19918 4087d0 GetLastError 19917->19918 19919 40870c FormatMessageW 19917->19919 19918->19919 19920 4087a8 19919->19920 19921 40874c WideCharToMultiByte 19919->19921 19924 402f90 9 API calls 19920->19924 19922 4087e0 19921->19922 19923 40879b 19921->19923 19926 402f90 9 API calls 19922->19926 19923->19911 19925 4087bc 19924->19925 19925->19911 19927 4087f4 19926->19927 19927->19911 19929 40f100 3 API calls 19928->19929 19930 402de7 19929->19930 19931 402df0 19930->19931 19932 402dfc 19931->19932 19933 408b00 10 API calls 19932->19933 19934 402e38 19933->19934 19935 402e90 MessageBoxA 19934->19935 19936 402e3c 19934->19936 19935->19915 19937 408b00 10 API calls 19936->19937 19938 402e5e MessageBoxW 19937->19938 19938->19915 19939 401e60 19940 402020 19939->19940 19941 401e75 19939->19941 19982 4046b0 19940->19982 19953 402014 19941->19953 19968 408550 malloc 19941->19968 19944 401eaa 19944->19953 19979 40ef60 19944->19979 19947 401ed4 fread 19950 402061 19947->19950 19951 401efd 19947->19951 19948 40208f 19949 403030 14 API calls 19948->19949 19949->19953 19952 403030 14 API calls 19950->19952 19954 40ef60 6 API calls 19951->19954 19952->19953 19955 401f57 malloc 19954->19955 19956 4020a5 19955->19956 19957 401f6d fread 19955->19957 19958 403030 14 API calls 19956->19958 19959 402046 19957->19959 19960 401f8f ferror 19957->19960 19958->19953 19988 403030 19959->19988 19961 40207c 19960->19961 19964 401fac 19960->19964 19963 402ed0 12 API calls 19961->19963 19963->19953 19966 402ed0 12 API calls 19964->19966 19967 401ff6 19964->19967 19965 402006 fclose 19965->19953 19966->19964 19967->19953 19967->19965 19969 408571 19968->19969 19970 4086b2 free 19968->19970 19971 40ef60 6 API calls 19969->19971 19970->19944 19973 40858d 19971->19973 19973->19970 19995 40f050 19973->19995 19975 40ef60 6 API calls 19977 4085a1 19975->19977 19976 40863f fread 19976->19970 19976->19977 19977->19970 19977->19975 19977->19976 19978 408670 memcmp 19977->19978 19978->19970 19978->19977 20000 40ef90 19979->20000 19983 4046bc 19982->19983 19984 408b00 12 API calls 19983->19984 19985 4046e1 19984->19985 19986 408b00 12 API calls 19985->19986 19987 4046fc _wfopen 19986->19987 19987->19941 19989 40f100 3 API calls 19988->19989 19990 403064 _errno strerror 19989->19990 19991 402dc0 3 API calls 19990->19991 19992 4030a3 19991->19992 19993 402df0 12 API calls 19992->19993 19994 4030bb 19993->19994 19994->19953 19998 40f070 fgetpos 19995->19998 19999 40f05f 19998->19999 19999->19977 20001 40efd8 fgetpos 20000->20001 20002 40efac 20000->20002 20003 40efec 20001->20003 20007 401ecc 20001->20007 20004 40f000 fflush _fileno _filelengthi64 20002->20004 20005 40efb1 20002->20005 20003->20004 20006 40efc1 fsetpos 20003->20006 20004->20006 20008 40efb5 20005->20008 20009 40f02a _errno 20005->20009 20006->20007 20007->19947 20007->19948 20008->20006 20009->20007 20010 4066e0 calloc 20011 4066fb 20010->20011 20012 4066ff 20010->20012 20013 403030 14 API calls 20012->20013 20013->20011 20014 401124 __wgetmainargs 20015 401de6 20016 401df0 20015->20016 20017 403030 14 API calls 20016->20017 20018 401d46 20017->20018 20019 401d5c fclose 20018->20019 20020 401d4d fclose 20018->20020 20021 401d68 20019->20021 20020->20019 20022 408668 20023 408670 memcmp 20022->20023 20025 4086b2 free 20023->20025 20026 4085d6 20023->20026 20026->20023 20026->20025 20027 40ef60 6 API calls 20026->20027 20028 40863f fread 20026->20028 20027->20026 20028->20025 20028->20026 20029 407dd0 20030 407dde 20029->20030 20059 4074f0 20030->20059 20033 407f05 20034 4074f0 3 API calls 20035 407e3c 20034->20035 20035->20033 20036 407e47 strlen strtok 20035->20036 20037 407f18 20036->20037 20038 407e6b 20036->20038 20039 408b00 12 API calls 20037->20039 20040 407e78 strlen 20038->20040 20057 408d40 13 API calls 20038->20057 20041 407f33 _wstat 20039->20041 20040->20033 20042 407e8c strlen strcpy strtok 20040->20042 20043 407f67 20041->20043 20044 407f48 20041->20044 20042->20037 20045 407ec2 20042->20045 20047 4046b0 13 API calls 20043->20047 20046 407f53 20044->20046 20053 407650 18 API calls 20044->20053 20048 408b00 12 API calls 20045->20048 20049 407ef5 20046->20049 20050 407f57 20046->20050 20051 407f77 20047->20051 20052 407ed6 _wstat 20048->20052 20062 402f30 20049->20062 20055 402f30 12 API calls 20050->20055 20052->20038 20052->20040 20056 407f8e 20053->20056 20055->20043 20056->20050 20058 407f9e free 20056->20058 20057->20038 20058->20046 20060 40f100 3 API calls 20059->20060 20061 407517 20060->20061 20061->20033 20061->20034 20063 40f100 3 API calls 20062->20063 20064 402f61 20063->20064 20065 402df0 12 API calls 20064->20065 20066 402f79 20065->20066 20066->20033 20067 40a090 20068 40a150 malloc 20067->20068 20069 40a0a9 20067->20069 20068->20069 20070 40a0f0 20068->20070 20071 40a100 memcpy 20069->20071 20072 40a0cf memcpy 20069->20072 20070->20071 20074 40a140 20070->20074 20071->20070 20073 40a190 memcpy 20071->20073 20072->20070 20075 408190 20076 40819e 20075->20076 20077 408b00 12 API calls 20076->20077 20078 4081cc SetConsoleCtrlHandler GetStartupInfoW 20077->20078 20079 40824b _fileno _get_osfhandle 20078->20079 20080 408274 _fileno _get_osfhandle 20079->20080 20081 408297 _fileno _get_osfhandle GetCommandLineW CreateProcessW 20080->20081 20082 408350 20081->20082 20083 40830e WaitForSingleObject GetExitCodeProcess 20081->20083 20084 402f90 12 API calls 20082->20084 20085 408364 20084->20085 20086 40a4b1 20087 40a436 malloc 20086->20087 20089 40a45c 20087->20089 20090 4011b3 20091 4011b8 20090->20091 20092 4011c0 Sleep 20091->20092 20097 4011ea 20091->20097 20094 4011cc 20092->20094 20093 401406 _amsg_exit 20095 401420 _initterm 20093->20095 20093->20097 20094->20091 20102 4011da 20094->20102 20095->20097 20096 401478 _initterm 20098 40149b 20096->20098 20097->20093 20097->20095 20097->20096 20097->20102 20100 4014a3 exit 20098->20100 20101 401241 SetUnhandledExceptionFilter 20101->20102 20102->20093 20102->20097 20103 401267 __p__wcmdln 20102->20103 20104 4012eb malloc 20102->20104 20105 4012e6 20102->20105 20116 40db40 20102->20116 20103->20102 20104->20098 20106 401311 20104->20106 20105->20104 20106->20106 20107 401346 malloc memcpy 20106->20107 20107->20106 20108 40136f 20107->20108 20128 40d770 20108->20128 20110 401388 20133 40d7a0 20110->20133 20113 4013c2 20114 4013d0 20113->20114 20115 401462 _cexit 20113->20115 20121 40db60 20116->20121 20127 40db53 20116->20127 20117 40dd9f 20119 40d980 11 API calls 20117->20119 20118 40dd00 20123 40dccd 20118->20123 20118->20127 20162 40d9e0 20118->20162 20122 40ddb9 20119->20122 20121->20117 20121->20118 20121->20123 20124 40d9e0 11 API calls 20121->20124 20121->20127 20136 40d980 20121->20136 20122->20101 20126 40dd72 VirtualProtect 20123->20126 20123->20127 20124->20121 20126->20123 20127->20101 20129 40d779 20128->20129 20132 40d710 20128->20132 20129->20110 20131 40d740 20131->20110 20186 4014d0 _onexit 20132->20186 20187 4015d0 20133->20187 20184 4173a0 20136->20184 20138 40d994 fwrite 20185 4173a0 20138->20185 20140 40d9c0 vfprintf abort 20146 40d9e0 20140->20146 20141 40da90 20141->20121 20142 40db27 20143 40d980 4 API calls 20142->20143 20156 40db37 20143->20156 20144 40da4b VirtualQuery 20145 40db07 20144->20145 20144->20146 20145->20142 20147 40d980 4 API calls 20145->20147 20146->20141 20146->20142 20146->20144 20148 40daa0 VirtualProtect 20146->20148 20147->20142 20148->20141 20149 40dae0 GetLastError 20148->20149 20150 40d980 4 API calls 20149->20150 20150->20146 20151 40dd9f 20153 40d980 4 API calls 20151->20153 20152 40dd00 20154 40d9e0 4 API calls 20152->20154 20159 40dccd 20152->20159 20161 40db53 20152->20161 20155 40ddb9 20153->20155 20154->20152 20155->20121 20156->20151 20156->20152 20157 40d9e0 VirtualQuery VirtualProtect GetLastError VirtualProtect 20156->20157 20158 40d980 4 API calls 20156->20158 20156->20159 20156->20161 20157->20156 20158->20156 20160 40dd72 VirtualProtect 20159->20160 20159->20161 20160->20159 20161->20121 20168 40d9f6 20162->20168 20163 40da90 20163->20118 20164 40db27 20165 40d980 7 API calls 20164->20165 20173 40db37 20165->20173 20166 40da4b VirtualQuery 20167 40db07 20166->20167 20166->20168 20167->20164 20169 40d980 7 API calls 20167->20169 20168->20163 20168->20164 20168->20166 20170 40daa0 VirtualProtect 20168->20170 20169->20164 20170->20163 20171 40dae0 GetLastError 20170->20171 20172 40d980 7 API calls 20171->20172 20172->20168 20174 40dd9f 20173->20174 20175 40dd00 20173->20175 20179 40d9e0 7 API calls 20173->20179 20180 40d980 7 API calls 20173->20180 20182 40dccd 20173->20182 20183 40db53 20173->20183 20176 40d980 7 API calls 20174->20176 20177 40d9e0 7 API calls 20175->20177 20175->20182 20175->20183 20178 40ddb9 20176->20178 20177->20175 20178->20118 20179->20173 20180->20173 20181 40dd72 VirtualProtect 20181->20182 20182->20181 20182->20183 20183->20118 20184->20138 20185->20140 20186->20131 20192 408a60 calloc 20187->20192 20189 4015ed 20200 403d60 20189->20200 20191 4013af 20191->20100 20191->20113 20193 408adb 20192->20193 20196 408a88 20192->20196 20193->20189 20194 408ae8 20194->20189 20195 408920 15 API calls 20195->20196 20196->20194 20196->20195 20197 408ab9 20196->20197 20198 408ac0 free 20197->20198 20198->20198 20199 408ad1 free 20198->20199 20199->20193 20201 403d6e 20200->20201 20292 4021e0 calloc 20201->20292 20205 404242 fclose 20207 403ecc 20205->20207 20206 403da0 20206->20207 20307 404670 strcpy strlen 20206->20307 20207->20205 20208 402ed0 12 API calls 20207->20208 20213 404190 20207->20213 20223 403ed4 strcmp 20207->20223 20240 403f11 strcpy 20207->20240 20245 407700 15 API calls 20207->20245 20283 406870 FreeLibrary 20207->20283 20289 406720 4 API calls 20207->20289 20335 403d30 20207->20335 20410 4037a0 20207->20410 20418 408190 20207->20418 20435 407bc0 20207->20435 20447 406980 20207->20447 20208->20207 20210 403dbb 20210->20207 20212 407650 18 API calls 20210->20212 20214 403dea 20212->20214 20429 402220 20213->20429 20217 403f70 20214->20217 20218 403df4 20214->20218 20221 407770 14 API calls 20217->20221 20220 407650 18 API calls 20218->20220 20222 403e00 20220->20222 20224 403f7c 20221->20224 20225 403e37 20222->20225 20229 4041a8 20222->20229 20230 403e18 free 20222->20230 20223->20207 20226 403f2d 20223->20226 20228 4020d0 51 API calls 20224->20228 20231 407770 14 API calls 20225->20231 20338 403cb0 20226->20338 20233 403f8c 20228->20233 20238 403740 12 API calls 20229->20238 20308 407770 20230->20308 20235 403e43 20231->20235 20233->20229 20236 403f94 20233->20236 20311 4020d0 20235->20311 20241 4020d0 51 API calls 20236->20241 20284 404076 20238->20284 20240->20226 20244 403fab 20241->20244 20242 403f3d 20347 406870 20242->20347 20249 403fe0 20244->20249 20250 403faf 20244->20250 20245->20207 20246 40407e 20254 4066e0 15 API calls 20246->20254 20247 4041e2 20260 408b00 12 API calls 20247->20260 20248 403e5b 20255 408b00 12 API calls 20248->20255 20252 4046b0 13 API calls 20249->20252 20251 402ed0 12 API calls 20250->20251 20257 403fcf 20251->20257 20259 403ff0 20252->20259 20253 4020d0 51 API calls 20261 4042bc 20253->20261 20262 403eb0 20254->20262 20256 403e90 20255->20256 20263 404229 20256->20263 20264 403e9f SetDllDirectoryW 20256->20264 20257->20191 20259->20207 20269 408550 11 API calls 20259->20269 20266 404205 20260->20266 20261->20248 20261->20250 20277 403ec0 20262->20277 20357 4061b0 20262->20357 20272 402ed0 12 API calls 20263->20272 20322 4066e0 calloc 20264->20322 20266->20263 20270 404209 SetDllDirectoryW 20266->20270 20268 406720 4 API calls 20273 403f5f 20268->20273 20274 404048 20269->20274 20275 4066e0 15 API calls 20270->20275 20272->20207 20273->20191 20274->20205 20353 403740 20274->20353 20275->20262 20276 4040a4 20276->20277 20279 4040ac 20276->20279 20277->20207 20326 406720 20277->20326 20372 406410 20279->20372 20283->20207 20284->20246 20284->20247 20285 4040bc 20286 4040cc 20285->20286 20400 406670 20285->20400 20286->20207 20288 406870 FreeLibrary 20286->20288 20290 4040e0 20288->20290 20289->20207 20291 406720 4 API calls 20290->20291 20291->20207 20293 4021fb 20292->20293 20294 4021ff 20292->20294 20293->20207 20296 4045d0 20293->20296 20295 403030 14 API calls 20294->20295 20295->20293 20297 40e630 20296->20297 20298 4045db GetModuleFileNameW 20297->20298 20299 404630 20298->20299 20300 404601 20298->20300 20301 402f90 12 API calls 20299->20301 20302 408920 15 API calls 20300->20302 20303 404644 20301->20303 20304 40461c 20302->20304 20303->20206 20305 402ed0 12 API calls 20304->20305 20306 404627 20304->20306 20305->20306 20306->20206 20307->20210 20309 408b00 12 API calls 20308->20309 20310 407791 SetEnvironmentVariableW free 20309->20310 20310->20225 20453 401950 20311->20453 20314 402104 20314->20248 20314->20253 20315 401950 3 API calls 20316 402136 20315->20316 20316->20314 20456 404300 20316->20456 20321 402184 fclose 20321->20314 20323 4066fb 20322->20323 20324 4066ff 20322->20324 20323->20262 20325 403030 14 API calls 20324->20325 20325->20323 20327 40676d 20326->20327 20328 40672f 20326->20328 20327->20207 20329 406741 20328->20329 20330 406739 free 20328->20330 20331 406753 20329->20331 20332 40674b free 20329->20332 20330->20329 20333 406765 free 20331->20333 20334 40675d free 20331->20334 20332->20331 20333->20327 20334->20333 20336 40f100 3 API calls 20335->20336 20337 403d57 20336->20337 20337->20207 20493 4056b0 20338->20493 20346 403cee 20346->20242 20348 406881 20347->20348 20352 403f53 20347->20352 20349 40691e 20348->20349 20348->20352 20850 408160 FreeLibrary 20348->20850 20349->20352 20851 408160 FreeLibrary 20349->20851 20352->20268 20354 403760 20353->20354 20355 403756 20353->20355 20354->20355 20356 401980 12 API calls 20354->20356 20355->20284 20356->20354 20358 4061d3 strncpy strncpy strncpy 20357->20358 20361 406360 20357->20361 20359 4043b0 7 API calls 20358->20359 20363 406243 calloc malloc malloc 20359->20363 20360 406368 20360->20276 20361->20360 20362 406387 20361->20362 20367 401980 12 API calls 20361->20367 20364 4019c0 35 API calls 20362->20364 20365 4062c7 20363->20365 20366 40638c 20363->20366 20364->20366 20365->20366 20369 4062d3 memcpy memcpy memcpy 20365->20369 20366->20360 20368 402ed0 12 API calls 20366->20368 20367->20361 20368->20360 20370 406340 free 20369->20370 20371 40632c 20369->20371 20370->20276 20371->20276 20373 40e630 20372->20373 20374 40641e calloc 20373->20374 20375 406640 strncpy 20374->20375 20380 40644d 20374->20380 20376 4065a0 strncpy 20375->20376 20377 4043b0 7 API calls 20376->20377 20379 4065d7 strncpy 20377->20379 20382 4043b0 7 API calls 20379->20382 20381 406470 memcpy 20380->20381 20383 406534 20380->20383 20384 4064e9 strlen 20380->20384 20397 406620 20380->20397 20888 402310 20380->20888 20385 4043b0 7 API calls 20381->20385 20386 4065fb 20382->20386 20387 402ed0 12 API calls 20383->20387 20384->20380 20390 406568 20384->20390 20388 4064a1 strlen strlen 20385->20388 20893 404380 20386->20893 20391 406549 free 20387->20391 20852 401bd0 20388->20852 20390->20375 20392 406577 20390->20392 20391->20285 20395 4043b0 7 API calls 20392->20395 20394 406607 20396 4043b0 7 API calls 20394->20396 20395->20376 20398 406619 20396->20398 20399 402ed0 12 API calls 20397->20399 20398->20391 20399->20398 20401 408100 14 API calls 20400->20401 20402 406683 20401->20402 20403 408100 14 API calls 20402->20403 20404 406697 20403->20404 20405 4066c0 20404->20405 20406 4066ab 20404->20406 20407 402ed0 12 API calls 20405->20407 20994 406d50 GetProcAddress 20406->20994 20409 4066b7 20407->20409 20409->20286 20411 4037d0 20410->20411 20413 4037d8 20410->20413 20411->20207 20412 401bd0 101 API calls 20412->20413 20413->20412 20415 401980 12 API calls 20413->20415 20416 403822 20413->20416 21088 403370 20413->21088 20415->20413 20416->20411 20417 402220 2 API calls 20416->20417 20417->20416 20419 40819e 20418->20419 20420 408b00 12 API calls 20419->20420 20421 4081cc SetConsoleCtrlHandler GetStartupInfoW 20420->20421 20422 40824b _fileno _get_osfhandle 20421->20422 20423 408274 _fileno _get_osfhandle 20422->20423 20424 408297 _fileno _get_osfhandle GetCommandLineW CreateProcessW 20423->20424 20425 408350 20424->20425 20426 40830e WaitForSingleObject GetExitCodeProcess 20424->20426 20427 402f90 12 API calls 20425->20427 20426->20207 20428 408364 20427->20428 20428->20207 20430 402249 20429->20430 20431 40222c 20429->20431 20430->20191 20432 402233 free 20431->20432 20433 40223b 20431->20433 20432->20433 20433->20430 20434 402241 fclose 20433->20434 20434->20430 20436 407bce 20435->20436 20437 408b00 12 API calls 20436->20437 20438 407bf9 wcscpy wcslen 20437->20438 20439 407c24 20438->20439 20440 407c2e wcscat _wfindfirst 20438->20440 20439->20440 20441 407cd0 wcscat 20439->20441 20442 407c80 20440->20442 20443 407c5e _wrmdir 20440->20443 20441->20440 21189 407cf0 20442->21189 20443->20207 20446 407cb8 _findclose 20446->20443 20448 406996 20447->20448 20449 4069ed 20448->20449 20450 402ed0 12 API calls 20448->20450 20449->20207 20451 406a5e 20450->20451 20452 406870 FreeLibrary 20451->20452 20452->20449 20454 40f100 3 API calls 20453->20454 20455 401977 20454->20455 20455->20314 20455->20315 20457 40430b 20456->20457 20458 4042d0 3 API calls 20457->20458 20459 404334 20458->20459 20460 40214f strcpy 20459->20460 20461 40e900 18 API calls 20459->20461 20464 401e60 20460->20464 20462 404348 20461->20462 20463 4042d0 3 API calls 20462->20463 20463->20460 20465 402020 20464->20465 20466 401e75 20464->20466 20468 4046b0 13 API calls 20465->20468 20467 408550 11 API calls 20466->20467 20478 402014 20466->20478 20469 401eaa 20467->20469 20468->20466 20470 40ef60 6 API calls 20469->20470 20469->20478 20471 401ecc 20470->20471 20472 401ed4 fread 20471->20472 20473 40208f 20471->20473 20475 402061 20472->20475 20476 401efd 20472->20476 20474 403030 14 API calls 20473->20474 20474->20478 20477 403030 14 API calls 20475->20477 20479 40ef60 6 API calls 20476->20479 20477->20478 20478->20314 20478->20321 20480 401f57 malloc 20479->20480 20481 4020a5 20480->20481 20482 401f6d fread 20480->20482 20483 403030 14 API calls 20481->20483 20484 402046 20482->20484 20485 401f8f ferror 20482->20485 20483->20478 20487 403030 14 API calls 20484->20487 20486 40207c 20485->20486 20489 401fac 20485->20489 20488 402ed0 12 API calls 20486->20488 20487->20478 20488->20478 20491 402ed0 12 API calls 20489->20491 20492 401ff6 20489->20492 20490 402006 fclose 20490->20478 20491->20489 20492->20478 20492->20490 20494 4056be 20493->20494 20571 405430 20494->20571 20497 4056f3 20500 4043b0 7 API calls 20497->20500 20518 405701 20497->20518 20498 4057ca 20499 402ed0 12 API calls 20498->20499 20517 403cc0 20499->20517 20503 40576a 20500->20503 20502 405717 20504 402ed0 12 API calls 20502->20504 20508 40571b 20502->20508 20506 402ed0 12 API calls 20503->20506 20510 40576e 20503->20510 20504->20508 20506->20510 20582 408100 20508->20582 20509 405723 20512 4057f0 20509->20512 20513 40572b 20509->20513 20752 4044f0 20510->20752 20511 405776 20516 408100 14 API calls 20511->20516 20511->20518 20515 402f90 12 API calls 20512->20515 20585 404760 GetProcAddress 20513->20585 20515->20517 20516->20518 20517->20346 20519 405a60 20517->20519 20574 4043b0 20518->20574 20520 407650 18 API calls 20519->20520 20521 405a75 20520->20521 20522 405a94 20521->20522 20525 402f30 12 API calls 20521->20525 20523 408b00 12 API calls 20522->20523 20524 405ad7 20523->20524 20526 405ca2 20524->20526 20527 405adf 20524->20527 20525->20522 20528 402ed0 12 API calls 20526->20528 20530 408b00 12 API calls 20527->20530 20529 403cd6 20528->20529 20529->20346 20556 405cf0 strlen 20529->20556 20531 405b0a 20530->20531 20532 405b12 20531->20532 20533 405ccb 20531->20533 20535 405430 3 API calls 20532->20535 20534 402ed0 12 API calls 20533->20534 20534->20529 20536 405b77 20535->20536 20537 405c78 20536->20537 20538 405b8a 20536->20538 20539 402ed0 12 API calls 20537->20539 20540 408b00 12 API calls 20538->20540 20539->20529 20541 405b9e 20540->20541 20542 405cb5 20541->20542 20543 405ba6 20541->20543 20544 402ed0 12 API calls 20542->20544 20756 405490 20543->20756 20544->20529 20546 405bc0 20771 408c20 calloc 20546->20771 20548 405beb 20549 405bf5 20548->20549 20550 405c8f 20548->20550 20552 405c31 free 20549->20552 20553 405c20 free 20549->20553 20551 402ed0 12 API calls 20550->20551 20551->20529 20554 405c3f 20552->20554 20553->20552 20553->20553 20554->20529 20555 402ed0 12 API calls 20554->20555 20555->20529 20557 405d26 20556->20557 20558 405dea 20557->20558 20565 405d2e 20557->20565 20559 402ed0 12 API calls 20558->20559 20560 403ce2 20559->20560 20560->20346 20566 405ed0 20560->20566 20561 401980 12 API calls 20561->20565 20563 402ed0 12 API calls 20563->20565 20564 405dba free 20564->20565 20565->20560 20565->20561 20565->20563 20565->20564 20784 4019c0 20565->20784 20567 405ee8 20566->20567 20568 405ee1 20566->20568 20567->20568 20570 401980 12 API calls 20567->20570 20842 405e00 strlen 20567->20842 20568->20346 20570->20567 20572 40f100 3 API calls 20571->20572 20573 405457 20572->20573 20573->20497 20573->20498 20575 4042d0 3 API calls 20574->20575 20576 4043de 20575->20576 20577 404450 20576->20577 20578 4043fa strlen 20576->20578 20577->20502 20578->20577 20579 40440d 20578->20579 20580 404430 strncat strlen 20579->20580 20581 40441f strncat 20579->20581 20580->20502 20581->20502 20583 408b00 12 API calls 20582->20583 20584 408121 LoadLibraryExW free 20583->20584 20584->20509 20586 404e16 20585->20586 20587 40478c GetProcAddress 20585->20587 20590 402f90 12 API calls 20586->20590 20588 4047a9 GetProcAddress 20587->20588 20589 404dfb 20587->20589 20592 404de0 20588->20592 20593 4047c6 GetProcAddress 20588->20593 20591 402f90 12 API calls 20589->20591 20594 404d9b 20590->20594 20591->20594 20595 402f90 12 API calls 20592->20595 20596 4047e3 GetProcAddress 20593->20596 20597 404eac 20593->20597 20594->20517 20595->20594 20599 404800 GetProcAddress 20596->20599 20600 404e8e 20596->20600 20598 402f90 12 API calls 20597->20598 20598->20594 20602 404e70 20599->20602 20603 40481d GetProcAddress 20599->20603 20601 402f90 12 API calls 20600->20601 20601->20594 20604 402f90 12 API calls 20602->20604 20605 404e52 20603->20605 20606 40483a GetProcAddress 20603->20606 20604->20594 20607 402f90 12 API calls 20605->20607 20608 404e34 20606->20608 20609 404857 GetProcAddress 20606->20609 20607->20594 20610 402f90 12 API calls 20608->20610 20611 4053f2 20609->20611 20612 404874 20609->20612 20610->20594 20613 402f90 12 API calls 20611->20613 20614 404882 GetProcAddress 20612->20614 20615 404da8 GetProcAddress 20612->20615 20613->20594 20616 404f24 20614->20616 20617 40489f GetProcAddress 20614->20617 20615->20614 20618 404dc5 20615->20618 20621 402f90 12 API calls 20616->20621 20619 404f06 20617->20619 20620 4048bc GetProcAddress 20617->20620 20622 402f90 12 API calls 20618->20622 20623 402f90 12 API calls 20619->20623 20624 404ee8 20620->20624 20625 4048d9 GetProcAddress 20620->20625 20621->20594 20622->20594 20623->20594 20628 402f90 12 API calls 20624->20628 20626 4048f6 GetProcAddress 20625->20626 20627 404eca 20625->20627 20629 404913 GetProcAddress 20626->20629 20630 404f9c 20626->20630 20631 402f90 12 API calls 20627->20631 20628->20594 20633 404930 GetProcAddress 20629->20633 20634 404f7e 20629->20634 20632 402f90 12 API calls 20630->20632 20631->20594 20632->20594 20635 404f60 20633->20635 20636 40494d GetProcAddress 20633->20636 20637 402f90 12 API calls 20634->20637 20640 402f90 12 API calls 20635->20640 20638 404f42 20636->20638 20639 40496a GetProcAddress 20636->20639 20637->20594 20641 402f90 12 API calls 20638->20641 20642 404987 GetProcAddress 20639->20642 20643 404fd8 20639->20643 20640->20594 20641->20594 20645 4049a4 GetProcAddress 20642->20645 20646 404fba 20642->20646 20644 402f90 12 API calls 20643->20644 20644->20594 20648 4049c1 GetProcAddress 20645->20648 20649 405014 20645->20649 20647 402f90 12 API calls 20646->20647 20647->20594 20650 404ff6 20648->20650 20651 4049de GetProcAddress 20648->20651 20652 402f90 12 API calls 20649->20652 20653 402f90 12 API calls 20650->20653 20654 4049fb GetProcAddress 20651->20654 20655 40506e 20651->20655 20652->20594 20653->20594 20657 405050 20654->20657 20658 404a18 GetProcAddress 20654->20658 20656 402f90 12 API calls 20655->20656 20656->20594 20659 402f90 12 API calls 20657->20659 20660 405032 20658->20660 20661 404a35 GetProcAddress 20658->20661 20659->20594 20662 402f90 12 API calls 20660->20662 20663 404a52 GetProcAddress 20661->20663 20664 40508c 20661->20664 20662->20594 20665 405122 20663->20665 20666 404a6f GetProcAddress 20663->20666 20667 402f90 12 API calls 20664->20667 20670 402f90 12 API calls 20665->20670 20668 405104 20666->20668 20669 404a8c GetProcAddress 20666->20669 20667->20594 20673 402f90 12 API calls 20668->20673 20671 4050e6 20669->20671 20672 404aa9 GetProcAddress 20669->20672 20670->20594 20674 402f90 12 API calls 20671->20674 20675 404ac6 GetProcAddress 20672->20675 20676 4050c8 20672->20676 20673->20594 20674->20594 20677 404ae3 GetProcAddress 20675->20677 20678 4050aa 20675->20678 20679 402f90 12 API calls 20676->20679 20680 405140 20677->20680 20681 404b00 GetProcAddress 20677->20681 20682 402f90 12 API calls 20678->20682 20679->20594 20685 402f90 12 API calls 20680->20685 20683 40517c 20681->20683 20684 404b1d GetProcAddress 20681->20684 20682->20594 20686 402f90 12 API calls 20683->20686 20687 404b3a GetProcAddress 20684->20687 20688 40515e 20684->20688 20685->20594 20686->20594 20689 404b57 GetProcAddress 20687->20689 20690 4051b8 20687->20690 20691 402f90 12 API calls 20688->20691 20693 404b74 GetProcAddress 20689->20693 20694 40519a 20689->20694 20692 402f90 12 API calls 20690->20692 20691->20594 20692->20594 20696 404b91 GetProcAddress 20693->20696 20697 4051f4 20693->20697 20695 402f90 12 API calls 20694->20695 20695->20594 20698 4051d6 20696->20698 20699 404bae GetProcAddress 20696->20699 20700 402f90 12 API calls 20697->20700 20701 402f90 12 API calls 20698->20701 20702 404bcb GetProcAddress 20699->20702 20703 40526c 20699->20703 20700->20594 20701->20594 20705 404be8 GetProcAddress 20702->20705 20706 40524e 20702->20706 20704 402f90 12 API calls 20703->20704 20704->20594 20708 405230 20705->20708 20709 404c05 GetProcAddress 20705->20709 20707 402f90 12 API calls 20706->20707 20707->20594 20712 402f90 12 API calls 20708->20712 20710 405212 20709->20710 20711 404c22 GetProcAddress 20709->20711 20713 402f90 12 API calls 20710->20713 20714 405320 20711->20714 20715 404c3f GetProcAddress 20711->20715 20712->20594 20713->20594 20718 402f90 12 API calls 20714->20718 20716 405302 20715->20716 20717 404c5c GetProcAddress 20715->20717 20721 402f90 12 API calls 20716->20721 20719 4052e4 20717->20719 20720 404c79 GetProcAddress 20717->20720 20718->20594 20724 402f90 12 API calls 20719->20724 20722 4052c6 20720->20722 20723 404c96 GetProcAddress 20720->20723 20721->20594 20725 402f90 12 API calls 20722->20725 20726 404cb3 GetProcAddress 20723->20726 20727 4052a8 20723->20727 20724->20594 20725->20594 20728 404cd0 GetProcAddress 20726->20728 20729 40528a 20726->20729 20730 402f90 12 API calls 20727->20730 20731 4053d4 20728->20731 20732 404ced GetProcAddress 20728->20732 20733 402f90 12 API calls 20729->20733 20730->20594 20736 402f90 12 API calls 20731->20736 20734 4053b6 20732->20734 20735 404d0a GetProcAddress 20732->20735 20733->20594 20739 402f90 12 API calls 20734->20739 20737 404d27 GetProcAddress 20735->20737 20738 405398 20735->20738 20736->20594 20741 404d44 GetProcAddress 20737->20741 20742 40537a 20737->20742 20740 402f90 12 API calls 20738->20740 20739->20594 20740->20594 20744 404d61 GetProcAddress 20741->20744 20745 40535c 20741->20745 20743 402f90 12 API calls 20742->20743 20743->20594 20747 40533e 20744->20747 20748 404d7e GetProcAddress 20744->20748 20746 402f90 12 API calls 20745->20746 20746->20594 20750 402f90 12 API calls 20747->20750 20748->20594 20749 405410 20748->20749 20751 402f90 12 API calls 20749->20751 20750->20594 20751->20594 20753 4044fb 20752->20753 20754 408b00 12 API calls 20753->20754 20755 40451c _wstat 20754->20755 20755->20511 20757 40549f 20756->20757 20759 4055b0 20757->20759 20760 405504 mbstowcs 20757->20760 20765 4055b8 20757->20765 20779 401980 20757->20779 20762 4055d7 _fileno _setmode 20759->20762 20759->20765 20760->20757 20761 405693 20760->20761 20763 402ed0 12 API calls 20761->20763 20764 4055fb _fileno _setmode 20762->20764 20763->20765 20766 405619 fflush 20764->20766 20765->20546 20767 40562a fflush 20766->20767 20768 40563b setbuf 20767->20768 20769 405654 setbuf 20768->20769 20770 40566d setbuf 20769->20770 20770->20546 20772 408c9b 20771->20772 20775 408c48 20771->20775 20772->20548 20773 408ca8 20773->20548 20774 408b00 12 API calls 20774->20775 20775->20773 20775->20774 20776 408c79 20775->20776 20777 408c80 free 20776->20777 20777->20777 20778 408c91 free 20777->20778 20778->20772 20780 4019a0 20779->20780 20781 401993 20779->20781 20782 402ed0 12 API calls 20780->20782 20781->20757 20783 4019ac 20782->20783 20783->20757 20785 401b30 20784->20785 20786 4019d9 20784->20786 20787 4046b0 13 API calls 20785->20787 20788 40ef60 6 API calls 20786->20788 20789 401b43 20787->20789 20790 4019fb 20788->20790 20789->20786 20791 401b51 20789->20791 20792 401b70 20790->20792 20793 401a07 malloc 20790->20793 20794 402ed0 12 API calls 20791->20794 20795 403030 14 API calls 20792->20795 20796 401a1e 20793->20796 20797 401b9f 20793->20797 20798 401af0 20794->20798 20799 401b8b 20795->20799 20801 401b00 20796->20801 20806 401a2c 20796->20806 20800 403030 14 API calls 20797->20800 20798->20565 20799->20565 20808 401adc 20800->20808 20811 401610 20801->20811 20803 401ae2 fclose 20803->20798 20804 401b14 20807 401ac8 free 20804->20807 20804->20808 20805 401a73 fread 20805->20806 20809 401aa5 20805->20809 20806->20805 20806->20808 20807->20808 20808->20798 20808->20803 20810 403030 14 API calls 20809->20810 20810->20807 20835 40a4f0 20811->20835 20814 401672 malloc 20816 401688 malloc 20814->20816 20817 401919 20814->20817 20815 4018d4 20818 402ed0 12 API calls 20815->20818 20819 4018f9 20816->20819 20829 4016a4 20816->20829 20821 403030 14 API calls 20817->20821 20820 401846 20818->20820 20822 403030 14 API calls 20819->20822 20820->20804 20823 401938 20821->20823 20826 401826 20822->20826 20824 4016d5 fread 20824->20826 20827 401701 ferror 20824->20827 20825 401858 20825->20804 20828 401832 free free 20826->20828 20827->20826 20827->20829 20828->20820 20829->20824 20829->20825 20829->20826 20831 401770 fwrite 20829->20831 20833 40187f memcpy 20829->20833 20834 4017e9 20829->20834 20830 402ed0 12 API calls 20830->20826 20832 40179c ferror 20831->20832 20831->20834 20832->20829 20832->20834 20833->20826 20833->20829 20834->20826 20834->20830 20838 40a3f0 20835->20838 20837 401668 20837->20814 20837->20815 20839 40a405 20838->20839 20841 40a45c 20838->20841 20840 40a43d malloc 20839->20840 20839->20841 20840->20841 20841->20837 20843 405e41 20842->20843 20844 405eab 20843->20844 20846 405e78 20843->20846 20845 402ed0 12 API calls 20844->20845 20847 405e89 20845->20847 20846->20847 20848 402ed0 12 API calls 20846->20848 20847->20567 20849 405ea0 20848->20849 20849->20567 20850->20349 20851->20352 20896 407b50 20852->20896 20854 401be7 20855 401d68 20854->20855 20905 407dd0 20854->20905 20855->20380 20857 401c0b 20858 401e16 20857->20858 20859 401c17 20857->20859 20861 403030 14 API calls 20858->20861 20860 401c22 20859->20860 20862 4046b0 13 API calls 20859->20862 20863 40ef60 6 API calls 20860->20863 20861->20855 20864 401d93 20862->20864 20865 401c3c 20863->20865 20864->20860 20866 401da0 20864->20866 20867 401df0 20865->20867 20868 401c44 20865->20868 20869 402ed0 12 API calls 20866->20869 20870 403030 14 API calls 20867->20870 20871 401d30 20868->20871 20872 401c4e malloc 20868->20872 20877 401d44 20869->20877 20870->20877 20874 401610 24 API calls 20871->20874 20873 401e3c 20872->20873 20875 401c64 20872->20875 20876 403030 14 API calls 20873->20876 20874->20877 20878 401cda fread 20875->20878 20887 401c6d 20875->20887 20876->20877 20879 401d5c fclose 20877->20879 20880 401d4d fclose 20877->20880 20882 401d01 20878->20882 20883 401c78 fwrite 20878->20883 20879->20855 20880->20879 20881 401d22 free 20881->20877 20885 403030 14 API calls 20882->20885 20883->20875 20884 401dc0 20883->20884 20886 403030 14 API calls 20884->20886 20885->20881 20886->20887 20887->20881 20889 402328 20888->20889 20890 40235b 20889->20890 20891 40232c strcmp 20889->20891 20892 402ed0 12 API calls 20889->20892 20890->20380 20891->20889 20891->20890 20892->20889 20977 40e660 setlocale 20893->20977 20897 407b70 20896->20897 20898 407b64 20896->20898 20935 402270 strlen 20897->20935 20898->20854 20900 407b80 20941 407940 20900->20941 20902 407b92 20903 407b96 20902->20903 20904 402ed0 12 API calls 20902->20904 20903->20854 20904->20898 20906 407dde 20905->20906 20907 4074f0 3 API calls 20906->20907 20908 407e07 20907->20908 20909 407f05 20908->20909 20910 4074f0 3 API calls 20908->20910 20909->20857 20911 407e3c 20910->20911 20911->20909 20912 407e47 strlen strtok 20911->20912 20913 407f18 20912->20913 20914 407e6b 20912->20914 20915 408b00 12 API calls 20913->20915 20916 407e78 strlen 20914->20916 20933 408d40 13 API calls 20914->20933 20917 407f33 _wstat 20915->20917 20916->20909 20918 407e8c strlen strcpy strtok 20916->20918 20919 407f67 20917->20919 20920 407f48 20917->20920 20918->20913 20921 407ec2 20918->20921 20923 4046b0 13 API calls 20919->20923 20922 407f53 20920->20922 20929 407650 18 API calls 20920->20929 20924 408b00 12 API calls 20921->20924 20925 407ef5 20922->20925 20926 407f57 20922->20926 20927 407f77 20923->20927 20928 407ed6 _wstat 20924->20928 20930 402f30 12 API calls 20925->20930 20931 402f30 12 API calls 20926->20931 20927->20857 20928->20914 20928->20916 20932 407f8e 20929->20932 20930->20909 20931->20919 20932->20926 20934 407f9e free 20932->20934 20933->20914 20934->20922 20936 402298 20935->20936 20937 4022be 20936->20937 20938 4022d0 strncmp 20936->20938 20940 402ed0 12 API calls 20936->20940 20937->20900 20938->20936 20939 4022ef 20938->20939 20939->20900 20940->20936 20942 40794e 20941->20942 20943 4079a7 GetTempPathW _getpid 20942->20943 20944 40795b 20942->20944 20945 4074c0 7 API calls 20943->20945 20946 407650 18 API calls 20944->20946 20947 4079e9 _wtempnam 20945->20947 20948 407967 20946->20948 20949 408d40 13 API calls 20947->20949 20950 4077c0 23 API calls 20948->20950 20951 407a00 20949->20951 20952 40797a 20950->20952 20953 407ab0 20951->20953 20954 407a08 free 20951->20954 20955 407984 _wputenv_s free 20952->20955 20956 407a8a 20952->20956 20958 408920 15 API calls 20953->20958 20954->20947 20959 407a15 20954->20959 20955->20943 20957 407aa0 20955->20957 20956->20902 20960 402ed0 12 API calls 20957->20960 20961 407ad0 free 20958->20961 20959->20956 20965 407a50 20959->20965 20966 407a28 20959->20966 20962 407aae 20960->20962 20963 407a42 20961->20963 20964 407ae7 20961->20964 20962->20963 20963->20902 20967 407b0c 20964->20967 20968 407aef 20964->20968 20970 408b00 12 API calls 20965->20970 20969 407700 15 API calls 20966->20969 20973 408b00 12 API calls 20967->20973 20971 407700 15 API calls 20968->20971 20972 407a3a free 20969->20972 20974 407a6c SetEnvironmentVariableW free 20970->20974 20975 407aff free 20971->20975 20972->20963 20976 407b28 SetEnvironmentVariableW free 20973->20976 20974->20956 20975->20963 20976->20963 20978 40e690 setlocale 20977->20978 20979 40e686 _strdup 20977->20979 20980 40e6a8 20978->20980 20981 40e6ad wcstombs realloc wcstombs setlocale free 20978->20981 20979->20978 20980->20981 20982 40e720 mbstowcs 20980->20982 20983 40438f strcpy 20981->20983 20984 40e630 20982->20984 20983->20394 20985 40e74c mbstowcs 20984->20985 20986 40e76b 20985->20986 20987 40e783 20986->20987 20988 40e790 20986->20988 20987->20981 20989 40e890 wcstombs realloc wcstombs 20988->20989 20990 40e80d wcstombs 20988->20990 20991 40e8db setlocale free 20989->20991 20992 40e822 20990->20992 20993 40e826 wcstombs 20990->20993 20991->20983 20992->20993 20993->20991 20995 4070f0 20994->20995 20996 406d81 GetProcAddress 20994->20996 20997 402f90 12 API calls 20995->20997 20998 407126 20996->20998 20999 406d9e GetProcAddress 20996->20999 21025 4070e7 20997->21025 21002 402f90 12 API calls 20998->21002 21000 40710b 20999->21000 21001 406dbb GetProcAddress 20999->21001 21005 402f90 12 API calls 21000->21005 21003 406dd8 GetProcAddress 21001->21003 21004 40715c 21001->21004 21002->21025 21006 407141 21003->21006 21007 406df5 GetProcAddress 21003->21007 21008 402f90 12 API calls 21004->21008 21005->21025 21011 402f90 12 API calls 21006->21011 21009 406e12 GetProcAddress 21007->21009 21010 4071b6 21007->21010 21008->21025 21012 407198 21009->21012 21013 406e2f GetProcAddress 21009->21013 21014 402f90 12 API calls 21010->21014 21011->21025 21015 402f90 12 API calls 21012->21015 21016 40717a 21013->21016 21017 406e4c GetProcAddress 21013->21017 21014->21025 21015->21025 21018 402f90 12 API calls 21016->21018 21019 4071d4 21017->21019 21020 406e69 GetProcAddress 21017->21020 21018->21025 21021 402f90 12 API calls 21019->21021 21022 406e86 GetProcAddress 21020->21022 21023 40724c 21020->21023 21021->21025 21026 406ea3 GetProcAddress 21022->21026 21027 40722e 21022->21027 21024 402f90 12 API calls 21023->21024 21024->21025 21025->20409 21029 407210 21026->21029 21030 406ec0 GetProcAddress 21026->21030 21028 402f90 12 API calls 21027->21028 21028->21025 21031 402f90 12 API calls 21029->21031 21032 4071f2 21030->21032 21033 406edd GetProcAddress 21030->21033 21031->21025 21034 402f90 12 API calls 21032->21034 21035 4072c4 21033->21035 21036 406efa GetProcAddress 21033->21036 21034->21025 21037 402f90 12 API calls 21035->21037 21038 4072a6 21036->21038 21039 406f17 GetProcAddress 21036->21039 21037->21025 21042 402f90 12 API calls 21038->21042 21040 406f34 GetProcAddress 21039->21040 21041 407288 21039->21041 21043 406f51 GetProcAddress 21040->21043 21044 40726a 21040->21044 21045 402f90 12 API calls 21041->21045 21042->21025 21046 4072e2 21043->21046 21047 406f6e GetProcAddress 21043->21047 21048 402f90 12 API calls 21044->21048 21045->21025 21051 402f90 12 API calls 21046->21051 21049 407300 21047->21049 21050 406f8b GetProcAddress 21047->21050 21048->21025 21054 402f90 12 API calls 21049->21054 21052 406fa8 GetProcAddress 21050->21052 21053 40733c 21050->21053 21051->21025 21055 406fc5 GetProcAddress 21052->21055 21056 40731e 21052->21056 21057 402f90 12 API calls 21053->21057 21054->21025 21058 406fe2 GetProcAddress 21055->21058 21059 407396 21055->21059 21060 402f90 12 API calls 21056->21060 21057->21025 21061 407378 21058->21061 21062 406fff GetProcAddress 21058->21062 21063 402f90 12 API calls 21059->21063 21060->21025 21064 402f90 12 API calls 21061->21064 21065 40735a 21062->21065 21066 40701c GetProcAddress 21062->21066 21063->21025 21064->21025 21067 402f90 12 API calls 21065->21067 21068 4073b4 21066->21068 21069 407039 GetProcAddress 21066->21069 21067->21025 21070 402f90 12 API calls 21068->21070 21071 407056 GetProcAddress 21069->21071 21072 40742c 21069->21072 21070->21025 21074 407073 GetProcAddress 21071->21074 21075 40740e 21071->21075 21073 402f90 12 API calls 21072->21073 21073->21025 21077 4073f0 21074->21077 21078 407090 GetProcAddress 21074->21078 21076 402f90 12 API calls 21075->21076 21076->21025 21079 402f90 12 API calls 21077->21079 21080 4073d2 21078->21080 21081 4070ad GetProcAddress 21078->21081 21079->21025 21082 402f90 12 API calls 21080->21082 21083 40744a 21081->21083 21084 4070ca GetProcAddress 21081->21084 21082->21025 21085 402f90 12 API calls 21083->21085 21084->21025 21086 407468 21084->21086 21085->21025 21087 402f90 12 API calls 21086->21087 21087->21025 21089 40337f 21088->21089 21145 4032f0 21089->21145 21092 403439 21092->20413 21093 404300 21 API calls 21094 4033c1 21093->21094 21151 4032a0 21094->21151 21097 403402 21098 407b50 67 API calls 21097->21098 21100 40340a 21098->21100 21099 4032a0 9 API calls 21101 403497 21099->21101 21102 403430 21100->21102 21156 407fd0 21100->21156 21101->21097 21103 40349f 21101->21103 21102->21092 21105 402ed0 12 API calls 21102->21105 21104 4032a0 9 API calls 21103->21104 21107 4034ca 21104->21107 21105->21092 21108 4034d2 21107->21108 21110 4032a0 9 API calls 21107->21110 21109 407b50 67 API calls 21108->21109 21144 4035dc 21108->21144 21116 4034e0 21109->21116 21111 4035a8 21110->21111 21111->21108 21114 4032a0 9 API calls 21111->21114 21112 402ed0 12 API calls 21112->21092 21113 4035e8 21118 4021e0 15 API calls 21113->21118 21114->21108 21115 403510 strcmp 21115->21116 21117 403523 21115->21117 21116->21113 21116->21115 21116->21144 21119 40352b 21117->21119 21120 40353c strcmp 21117->21120 21126 401980 12 API calls 21117->21126 21121 4035f9 21118->21121 21119->21092 21125 402ed0 12 API calls 21119->21125 21120->21117 21122 403556 21120->21122 21121->21144 21177 403270 21121->21177 21123 401bd0 101 API calls 21122->21123 21123->21119 21128 403574 21125->21128 21126->21117 21128->20413 21129 4036d0 21131 402ed0 12 API calls 21129->21131 21130 403270 3 API calls 21134 403667 21130->21134 21132 4036dc 21131->21132 21133 402220 2 API calls 21132->21133 21133->21144 21134->21129 21135 403270 3 API calls 21134->21135 21136 40369c 21135->21136 21136->21129 21137 4036a3 21136->21137 21138 401e60 31 API calls 21137->21138 21139 4036ba 21138->21139 21140 4036c2 21139->21140 21141 402ed0 12 API calls 21139->21141 21140->20413 21142 403728 21141->21142 21143 402220 2 API calls 21142->21143 21143->21144 21144->21112 21146 403270 3 API calls 21145->21146 21147 40331d 21146->21147 21148 403324 strchr 21147->21148 21150 40334f 21147->21150 21149 403338 strcpy 21148->21149 21148->21150 21149->21150 21150->21092 21150->21093 21152 40f100 3 API calls 21151->21152 21153 4032c8 21152->21153 21154 4032df 21153->21154 21180 40ed40 21153->21180 21154->21097 21154->21099 21157 407fdd 21156->21157 21158 4046b0 13 API calls 21157->21158 21159 407ff6 21158->21159 21160 407dd0 41 API calls 21159->21160 21161 408012 21160->21161 21162 4080e8 21161->21162 21163 408024 21161->21163 21164 4080dc 21161->21164 21165 4080bd fclose 21162->21165 21166 4080c5 21162->21166 21167 408030 feof 21163->21167 21164->21162 21168 4080e0 fclose 21164->21168 21165->21166 21166->21102 21169 408040 fread 21167->21169 21170 4080d8 21167->21170 21168->21162 21172 408080 fwrite 21169->21172 21173 408060 ferror 21169->21173 21171 4080b5 fclose 21170->21171 21171->21165 21174 4080a8 clearerr 21172->21174 21175 40809c ferror 21172->21175 21173->21167 21176 40806c clearerr 21173->21176 21174->21171 21175->21167 21175->21174 21176->21171 21176->21172 21178 40f100 3 API calls 21177->21178 21179 403297 21178->21179 21179->21129 21179->21130 21181 40ed53 21180->21181 21182 40ed5c _stat 21180->21182 21181->21182 21183 40edc0 strlen 21181->21183 21184 40ed6e 21182->21184 21183->21182 21185 40edcf 21183->21185 21184->21154 21185->21182 21186 40edf5 malloc memcpy _stat 21185->21186 21188 40ee4e 21185->21188 21186->21184 21187 40ee36 free 21186->21187 21187->21184 21188->21182 21190 40e630 21189->21190 21191 407cfe wcscmp 21190->21191 21192 407d30 wcscmp 21191->21192 21204 407c99 _wfindnext 21191->21204 21193 407d44 wcscat 21192->21193 21192->21204 21194 407d90 _wremove 21193->21194 21195 407d63 21193->21195 21197 407d9c Sleep _wremove 21194->21197 21194->21204 21205 408f20 FindFirstFileExW 21195->21205 21197->21204 21199 407dc0 _wrmdir 21199->21204 21200 407d6c 21201 408920 15 API calls 21200->21201 21202 407d84 21201->21202 21203 407bc0 25 API calls 21202->21203 21203->21204 21204->20442 21204->20446 21206 408f66 FindClose 21205->21206 21207 407d68 21205->21207 21206->21207 21207->21199 21207->21200 21208 4017f4 21215 4016b1 21208->21215 21209 4017e9 21213 401826 21209->21213 21214 402ed0 12 API calls 21209->21214 21210 401770 fwrite 21210->21209 21211 40179c ferror 21210->21211 21211->21209 21211->21215 21212 40187f memcpy 21212->21213 21212->21215 21216 401832 free free 21213->21216 21214->21213 21215->21209 21215->21210 21215->21212 21215->21213 21218 4016d5 fread 21215->21218 21219 401858 21215->21219 21217 401846 21216->21217 21218->21213 21220 401701 ferror 21218->21220 21220->21213 21220->21215 21221 4018b6 21222 401826 21221->21222 21223 401832 free free 21222->21223 21224 401846 21223->21224 21225 408e58 21226 408e60 GetTokenInformation 21225->21226 21227 408ea1 calloc 21226->21227 21228 408e92 GetLastError 21226->21228 21229 408d96 21227->21229 21230 408ec3 GetTokenInformation 21227->21230 21228->21227 21228->21229 21231 408d9c free 21229->21231 21230->21231 21232 408eeb ConvertSidToStringSidW 21230->21232 21233 408db9 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 21231->21233 21234 408dad FindCloseChangeNotification 21231->21234 21232->21231 21235 408e4d 21233->21235 21236 408e2c CreateDirectoryW 21233->21236 21234->21233 21236->21235

                                          Executed Functions

                                          Function 0040117C Relevance: 18.2, APIs: 12, Instructions: 206sleepCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 323 40117c-40119a 324 4011a0-4011b1 323->324 325 401451-40145a GetStartupInfoW 323->325 326 4011cc-4011d8 324->326 329 401462-401477 _cexit 325->329 327 4011b8-4011ba 326->327 328 4011da-4011e4 326->328 332 4011c0-4011c9 Sleep 327->332 333 4013f3-401400 327->333 330 401406-40141a _amsg_exit 328->330 331 4011ea-4011f1 328->331 334 401420-401440 _initterm 330->334 335 40120f-401211 330->335 336 4011f7-401209 331->336 337 401478-401491 _initterm 331->337 332->326 333->330 333->331 338 401446-40144c 334->338 339 401217-40121e 334->339 335->338 335->339 336->334 336->335 342 40149b 337->342 338->339 340 401220-401239 339->340 341 40123c-40127c call 40db40 SetUnhandledExceptionFilter call 4173c0 call 40d970 __p__wcmdln 339->341 340->341 351 401292-401299 341->351 352 40127e 341->352 345 4014a3-4014af exit 342->345 354 401280-401283 351->354 355 40129b-4012a7 351->355 353 4012cd-4012d5 352->353 356 4012d7-4012e0 353->356 357 4012eb-40130b malloc 353->357 358 401285-401288 354->358 359 4012a9-4012b0 354->359 360 40128f 355->360 361 4012e6 356->361 362 4013ea 356->362 357->342 364 401311-40131d 357->364 358->359 363 40128a 358->363 365 4012b2 359->365 366 4012c8 359->366 360->351 361->357 362->333 363->360 367 401320-401326 364->367 368 4012b8-4012c6 365->368 366->353 369 4013e0-4013e5 367->369 370 40132c-401331 367->370 368->366 368->368 372 401346-40136d malloc memcpy 369->372 371 401338-401341 370->371 371->371 373 401343 371->373 372->367 374 40136f-4013bc call 40d770 call 40d7a0 372->374 373->372 374->345 379 4013c2-4013ca 374->379 379->329 380 4013d0-4013db 379->380
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction ID: 676354774380156a6d31bcdc11651c5caae96c91ab7a06ee3bbcf8190cbc5d75
                                          • Opcode Fuzzy Hash: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction Fuzzy Hash: BF81AF70A042018FDB24EFA4D98576A77F0FB44304F51453EDA85AB3B1D7789885CB8A
                                          Function 00401BD0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 151COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                            • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                            • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                          • malloc.MSVCRT ref: 00401C55
                                          • fread.MSVCRT ref: 00401CF4
                                          • free.MSVCRT ref: 00401D25
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • fread, xrefs: 00401D12
                                          • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                          • fwrite, xrefs: 00401DD1
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                          • fseek, xrefs: 00401E01
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                          • fopen, xrefs: 00401E27
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401D05
                                          • Failed to extract %s: failed to open target file!, xrefs: 00401E1A
                                          • Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00401E40
                                          • malloc, xrefs: 00401E4B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$fclosestrtok$_wstatfreadfreemallocstrcpy
                                          • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                          • API String ID: 3544345225-666925554
                                          • Opcode ID: 4440eb1eb03a3154bd87365db13383f04021bbf881c10f7881478c95f5f3f3c7
                                          • Instruction ID: b5f998b2d191bd7786349188155599ad4440f4e1001f158a4c3b14c5a7e7e59c
                                          • Opcode Fuzzy Hash: 4440eb1eb03a3154bd87365db13383f04021bbf881c10f7881478c95f5f3f3c7
                                          • Instruction Fuzzy Hash: 5C510AB05093419BD710EF29C48465FBBE1BF84354F118D2EF8E59B391D778E8858B4A
                                          Function 00407940 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 126COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • _wputenv_s.MSVCRT ref: 0040798F
                                          • free.MSVCRT ref: 0040799A
                                          • GetTempPathW.KERNEL32(?,00000000,?,?,00407B92), ref: 004079BB
                                          • _getpid.MSVCRT ref: 004079C4
                                          • _wtempnam.MSVCRT ref: 004079F0
                                          • free.MSVCRT ref: 00407A0B
                                          • free.MSVCRT ref: 00407A3D
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                            • Part of subcall function 004077C0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                            • Part of subcall function 004077C0: free.MSVCRT ref: 0040781A
                                            • Part of subcall function 004077C0: _wfullpath.MSVCRT ref: 0040784A
                                            • Part of subcall function 004077C0: wcschr.MSVCRT ref: 00407877
                                            • Part of subcall function 004077C0: wcsncpy.MSVCRT ref: 004078A7
                                            • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078B7
                                            • Part of subcall function 004077C0: wcschr.MSVCRT ref: 004078C7
                                            • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078DD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                          • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                          • API String ID: 2180377646-1116378104
                                          • Opcode ID: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                          • Instruction ID: 01c5aea6ddf612d932d95327d8216bd8a762320b70d46ed771eeb73c9fc8ba7f
                                          • Opcode Fuzzy Hash: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                          • Instruction Fuzzy Hash: 8E41CCB1A0D7008FD710BF65E58536FBBE0AF84744F02882EE5C897242D77D94859B9B
                                          Function 00401610 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 186fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 86 401610-40166c call 40a4f0 89 401672-401682 malloc 86->89 90 4018d4-4018f4 call 402ed0 86->90 91 401688-40169e malloc 89->91 92 401919-401938 call 403030 89->92 99 401846-401852 90->99 94 4016a4-4016ad 91->94 95 4018f9-401914 call 403030 91->95 98 4016b1-4016cf 94->98 107 401826-401841 call 40c7c0 free * 2 95->107 102 4016d5-4016fb fread 98->102 103 401858-401868 98->103 105 4018c0-4018c5 102->105 106 401701-40170f ferror 102->106 105->107 106->105 108 401715-40171d 106->108 107->99 110 401721-40174a call 40a5c0 108->110 114 401750-401753 110->114 115 4017f8-4017fb 110->115 117 401759-40176a 114->117 118 401806-40181d 114->118 116 401801 115->116 115->117 116->118 120 401870-401879 117->120 121 401770-401796 fwrite 117->121 118->107 119 401821 call 402ed0 118->119 119->107 124 4017b4-4017b6 120->124 125 40187f-4018b1 memcpy 120->125 122 4018ca-4018cf 121->122 123 40179c-4017aa ferror 121->123 122->118 123->122 126 4017b0 123->126 124->110 127 4017bc-4017dd 124->127 125->105 125->124 126->124 127->107 128 4017df-4017e3 127->128 128->98 129 4017e9-4017f0 128->129 129->107 130 4017f2 129->130 130->118
                                          APIs
                                          Strings
                                          • 1.2.13, xrefs: 00401628
                                          • 8, xrefs: 00401620
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          • Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 004018E1
                                          • Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 004018FC
                                          • Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 0040191D
                                          • malloc, xrefs: 00401908, 00401925
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ferrorfreemalloc$freadfwritememcpy
                                          • String ID: 1.2.13$8$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                          • API String ID: 3882407908-2046485118
                                          • Opcode ID: 5aace083163d09cb8bea982305f06aca8e3756abcd3827cc7d3909b427364719
                                          • Instruction ID: 36ffe3033784580453c6a567143783feaca3ec72a60cee7d1f4dfc22211088d5
                                          • Opcode Fuzzy Hash: 5aace083163d09cb8bea982305f06aca8e3756abcd3827cc7d3909b427364719
                                          • Instruction Fuzzy Hash: F481D3B56093019FD750EF29C08461BBBE1BF88358F508A2EF4D8973A1E778D985CB46
                                          Function 00401E60 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 165COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 131 401e60-401e6f 132 402020-402039 call 4046b0 131->132 133 401e75-401eb0 call 408550 131->133 132->133 139 40203f-402044 132->139 138 401eb6-401ece call 40ef60 133->138 133->139 143 401ed4-401ef7 fread 138->143 144 40208f-4020a3 call 403030 138->144 141 402014-40201d 139->141 146 402061-40207a call 403030 143->146 147 401efd-401f67 call 40ef60 malloc 143->147 144->139 146->141 153 4020a5-4020bc call 403030 147->153 154 401f6d-401f89 fread 147->154 153->141 156 402046-40205f call 403030 154->156 157 401f8f-401fa6 ferror 154->157 156->141 158 40207c-40208d call 402ed0 157->158 159 401fac-401fb2 157->159 158->141 163 401fb8-401fba 159->163 165 402000-402004 163->165 166 401fbc-401fdf 163->166 165->141 169 402006-40200e fclose 165->169 166->163 168 401fe1-401ff4 call 402ed0 166->168 168->166 172 401ff6-401ffd 168->172 169->141 172->165
                                          APIs
                                            • Part of subcall function 00408550: malloc.MSVCRT ref: 00408562
                                            • Part of subcall function 00408550: fread.MSVCRT ref: 00408656
                                            • Part of subcall function 00408550: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401EAA), ref: 004086BF
                                          • fread.MSVCRT ref: 00401EF0
                                          • malloc.MSVCRT ref: 00401F5D
                                          • fread.MSVCRT ref: 00401F82
                                          • ferror.MSVCRT ref: 00401F9D
                                          • fclose.MSVCRT ref: 00402009
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fread$malloc$fcloseferrorfree
                                          • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$X$fread$fseek$malloc
                                          • API String ID: 938791849-202209224
                                          • Opcode ID: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction ID: 48232b83441798ba76066763261cf49e77d2abc7de2ba2fc6216de52d01d1662
                                          • Opcode Fuzzy Hash: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction Fuzzy Hash: 40616EB0905301CFCB04DF25C58865ABBE1BF88314F15C96EE9989B3D6D778D884CB9A
                                          Function 0040E900 Relevance: 27.3, APIs: 18, Instructions: 269COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 173 40e900-40e921 setlocale 174 40e923-40e92b _strdup 173->174 175 40e92d-40e946 setlocale 173->175 174->175 176 40e950-40e9b1 wcstombs realloc wcstombs setlocale free 175->176 177 40e948-40e94e 175->177 179 40e9b7-40e9c0 176->179 177->176 178 40e9c8-40ea1f mbstowcs call 40e630 mbstowcs 177->178 182 40ea60-40ea64 178->182 183 40ea21-40ea32 178->183 186 40ea67-40ea6c 182->186 184 40ec40-40ec44 183->184 185 40ea38-40ea3c 183->185 184->186 187 40ec4a-40ec4f 184->187 185->184 188 40ea42-40ea46 185->188 189 40ea80-40ea89 186->189 190 40ea6e-40ea71 186->190 187->186 191 40ec55-40ec70 setlocale free 187->191 188->186 192 40ea48-40ea56 188->192 193 40eaa4-40eaa8 189->193 190->176 194 40eb66-40eb69 191->194 192->186 195 40ea90-40ea96 193->195 196 40eaaa-40eab1 193->196 194->179 197 40ea98-40eaa2 195->197 198 40eabb-40eac2 195->198 199 40eab3-40eab7 196->199 200 40eac4-40eac8 196->200 197->193 203 40ead8-40eadb 197->203 198->200 201 40eab8 198->201 199->201 200->201 202 40eaca-40eacf 200->202 201->198 202->203 204 40ead1-40ead3 202->204 205 40eb70-40eb78 203->205 206 40eae1-40eae9 203->206 204->197 209 40eccb 205->209 210 40eb7e-40eb85 205->210 207 40eaeb-40eaef 206->207 208 40eafc-40eb49 wcstombs realloc wcstombs 206->208 207->208 211 40eaf1-40eaf9 207->211 212 40eb4e-40eb61 setlocale free 208->212 213 40ecd1-40ecd9 209->213 214 40eb8d-40eb9c 209->214 210->205 215 40eb87-40eb8b 210->215 211->208 212->194 216 40ece5-40eced 213->216 217 40ecdb-40ecdf 213->217 218 40ebb0-40ebbb 214->218 219 40eb9e-40eba2 214->219 215->205 215->214 216->214 221 40ecf3-40ecfb 216->221 217->214 217->216 218->218 220 40ebbd-40ebc1 218->220 222 40ec75-40ec79 219->222 223 40eba8-40ebaf 219->223 220->218 224 40ebc3-40ebca 220->224 221->214 227 40ed01-40ed08 221->227 225 40ebd0 222->225 226 40ec7f-40ec82 222->226 223->218 224->222 224->225 228 40ebd2-40ebd5 225->228 226->228 227->214 229 40ec9b-40ecbc wcstombs 228->229 230 40ebdb-40ebe0 228->230 229->212 232 40ecc2-40ecc6 229->232 231 40ec06-40ec11 230->231 233 40ec13 231->233 234 40ebe8-40ebf3 231->234 232->212 237 40ec16-40ec1a 233->237 235 40ec90-40ec92 234->235 236 40ebf9-40ebfb 234->236 235->237 238 40ebfd-40ec00 236->238 239 40ec28-40ec33 237->239 240 40ec1c-40ec22 237->240 238->231 241 40ec98 238->241 239->239 243 40ec35-40ec39 239->243 240->238 242 40ec24 240->242 241->229 242->239 243->239 244 40ec3b 243->244 244->238
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction ID: 614429c9ea5f0c0fbdd7ec2be82af17343d93239b7468d5b99009060838935dd
                                          • Opcode Fuzzy Hash: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction Fuzzy Hash: 48A161709042158ADB24AF66C0452BBF7F1FF44344F45883FE489A7391E33D9892DB8A
                                          Function 00408D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 108COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetCurrentProcess.KERNEL32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D68
                                          • OpenProcessToken.ADVAPI32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D81
                                          • free.MSVCRT ref: 00408D9F
                                          • FindCloseChangeNotification.KERNELBASE ref: 00408DB0
                                          • _snwprintf.MSVCRT ref: 00408DDE
                                          • LocalFree.KERNEL32 ref: 00408DE7
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                          • CreateDirectoryW.KERNELBASE ref: 00408E3A
                                          • GetTokenInformation.KERNELBASE ref: 00408E89
                                          • GetLastError.KERNEL32 ref: 00408E92
                                          • calloc.MSVCRT ref: 00408EB0
                                          • GetTokenInformation.KERNELBASE ref: 00408EDA
                                          • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen_snwprintfcallocfree
                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                          • API String ID: 2844154730-2855260032
                                          • Opcode ID: 35c38e4ae291b1630caa3689cb7816c22af486aa1896671bf02661883c98cb07
                                          • Instruction ID: 945ac7356c52e091193055c5d6ee7abddb38f98d0a82e690350cb517e8796f62
                                          • Opcode Fuzzy Hash: 35c38e4ae291b1630caa3689cb7816c22af486aa1896671bf02661883c98cb07
                                          • Instruction Fuzzy Hash: 2E41C4B05083009FE700AF69D68825EBBE4BF84755F418E2EF8D9A7291D778D548CF86
                                          Function 00408190 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 107processsynchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • SetConsoleCtrlHandler.KERNEL32(00000000,?,00000000,?,00404169), ref: 004081DB
                                          • GetStartupInfoW.KERNEL32 ref: 00408203
                                          • _fileno.MSVCRT ref: 0040824E
                                          • _get_osfhandle.MSVCRT ref: 0040825C
                                          • _fileno.MSVCRT ref: 00408277
                                          • _get_osfhandle.MSVCRT ref: 0040827F
                                          • _fileno.MSVCRT ref: 0040829A
                                          • _get_osfhandle.MSVCRT ref: 004082A2
                                          • GetCommandLineW.KERNEL32 ref: 004082B1
                                          • CreateProcessW.KERNELBASE ref: 00408301
                                          • WaitForSingleObject.KERNEL32 ref: 0040831D
                                          • GetExitCodeProcess.KERNEL32 ref: 00408335
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                          • String ID: CreateProcessW$Error creating child process!
                                          • API String ID: 1833775142-3524285272
                                          • Opcode ID: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                          • Instruction ID: e1b98e6d24d483291a0d25806d4a7f2563c0c3411ac3d46acccf3020f7941406
                                          • Opcode Fuzzy Hash: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                          • Instruction Fuzzy Hash: E14195B05083448FD710AF69D58935EBBF0BF84314F418E2EE8D887291D7B99488CF96
                                          Function 00408E58 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 86COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • free.MSVCRT ref: 00408D9F
                                          • FindCloseChangeNotification.KERNELBASE ref: 00408DB0
                                          • _snwprintf.MSVCRT ref: 00408DDE
                                          • LocalFree.KERNEL32 ref: 00408DE7
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                          • CreateDirectoryW.KERNELBASE ref: 00408E3A
                                          • GetTokenInformation.KERNELBASE ref: 00408E89
                                          • GetLastError.KERNEL32 ref: 00408E92
                                          • calloc.MSVCRT ref: 00408EB0
                                          • GetTokenInformation.KERNELBASE ref: 00408EDA
                                          • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ConvertDescriptorInformationSecurityStringToken$ChangeCloseCreateDirectoryErrorFindFreeLastLocalNotification_snwprintfcallocfree
                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                          • API String ID: 897783455-2855260032
                                          • Opcode ID: 2332b92793a97980f153f3f9263dafc3eb451ab906240b9714cbdf3afaf22637
                                          • Instruction ID: 5ee2362bb1dffc1b92a9066ae5264b9d3527a87a2536074db898feb824fd9f33
                                          • Opcode Fuzzy Hash: 2332b92793a97980f153f3f9263dafc3eb451ab906240b9714cbdf3afaf22637
                                          • Instruction Fuzzy Hash: 8C31D3B05083009FE700AF69D68835EBBE0FF84715F01892EE8D9972A1D778D988CF46
                                          Function 00407DD0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122stringCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 285 407dd0-407e0c call 40e630 call 4074f0 290 407e12-407e41 call 4074f0 285->290 291 407f05-407f11 285->291 290->291 294 407e47-407e65 strlen strtok 290->294 295 407f18-407f46 call 408b00 _wstat 294->295 296 407e6b-407e72 294->296 301 407f67-407f81 call 4046b0 295->301 302 407f48-407f51 295->302 298 407e78-407e8a strlen 296->298 298->291 300 407e8c-407ec0 strlen strcpy strtok 298->300 300->295 303 407ec2-407ee9 call 408b00 _wstat 300->303 304 407f82-407f90 call 407650 302->304 305 407f53-407f55 302->305 303->298 315 407eeb-407ef3 call 408d40 303->315 318 407f92-407f98 304->318 319 407fb5-407fbf 304->319 308 407ef5-407f00 call 402f30 305->308 309 407f57-407f62 call 402f30 305->309 308->291 309->301 315->298 320 407f9a 318->320 321 407f9e-407fb3 free 318->321 319->309 320->321 321->305
                                          APIs
                                          Strings
                                          • ERROR: file already exists but should not: %s, xrefs: 00407EF9
                                          • PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00407F82
                                          • WARNING: file already exists but should not: %s, xrefs: 00407F5B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$_wstatstrtok$ByteCharMultiWidefreestrcpy
                                          • String ID: ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s
                                          • API String ID: 439695417-1996835591
                                          • Opcode ID: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                          • Instruction ID: 0d1752cbd12df257bbbd412badab65e831f2b54a7211b67fa555c1920da682f5
                                          • Opcode Fuzzy Hash: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                          • Instruction Fuzzy Hash: DE411CB050D7019AD310AF25D58429EBBE4EF84748F42883EE5C897391DB7CA4849B9B
                                          Function 0040EF90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 381 40ef90-40efaa 382 40efd8-40efea fgetpos 381->382 383 40efac-40efaf 381->383 384 40f03c-40f041 382->384 385 40efec-40eff4 382->385 386 40f000-40f028 fflush _fileno _filelengthi64 383->386 387 40efb1-40efb3 383->387 389 40efcd-40efd4 384->389 385->386 388 40efc1-40efc8 fsetpos 385->388 386->388 390 40efb5-40efbd 387->390 391 40f02a-40f03a _errno 387->391 388->389 390->388 391->389
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
                                          • String ID:
                                          • API String ID: 4183758535-0
                                          • Opcode ID: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction ID: 4b13233adec89eef7c79cf0ca00fcee1fa5ec0274880c3d786e8fbaf61c832b7
                                          • Opcode Fuzzy Hash: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction Fuzzy Hash: 7A113DB15087059BC310AF2A958105FBBE4EF91354F120D3FF89493292E239D999CB96
                                          Function 00401DBB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 392 401dbb-401de1 free call 403030 398 401d5c-401d63 fclose 392->398 399 401d4d-401d55 fclose 392->399 400 401d68-401d71 398->400 399->398
                                          APIs
                                            • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                            • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                          • free.MSVCRT ref: 00401D25
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                          • fwrite, xrefs: 00401DD1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_errnofreestrerror
                                          • String ID: Failed to extract %s: failed to write data chunk!$fwrite
                                          • API String ID: 3523629215-1560601992
                                          • Opcode ID: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                          • Instruction ID: aff44569ab8606813c7f29ae03d31c1d370def72fb3cd313521a05d94b0daf67
                                          • Opcode Fuzzy Hash: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                          • Instruction Fuzzy Hash: 43F012B56093408BC700AF75E48519DB7E0BF80314F12892FF4999B291D338D485CB4A
                                          Function 00401DE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 401 401de6-401e11 call 403030 406 401d5c-401d63 fclose 401->406 407 401d4d-401d55 fclose 401->407 408 401d68-401d71 406->408 407->406
                                          APIs
                                            • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                            • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • fseek, xrefs: 00401E01
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_errnostrerror
                                          • String ID: Failed to extract %s: failed to seek to the entry's data!$fseek
                                          • API String ID: 531001455-144044986
                                          • Opcode ID: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                          • Instruction ID: b1b358e5bfedda9d4d999058601c1f88ca93a78291f5d028d604a8f107234477
                                          • Opcode Fuzzy Hash: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                          • Instruction Fuzzy Hash: D2F06C756053419BCB00AF39D844299B7F1FF80318F05892FF89997390D338E985CB49
                                          Function 00408550 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 409 408550-40856b malloc 410 408571-40858f call 40ef60 409->410 411 4086b8-4086ba 409->411 410->411 415 408595-4085b8 call 40f050 410->415 413 4086bc-4086cf free 411->413 415->411 418 4085be-4085d2 415->418 419 4085d6-4085ec 418->419 420 4085fe-40861d 419->420 421 4085ee-4085f6 419->421 422 4086b2-4086b4 420->422 423 408623-40863d call 40ef60 420->423 421->420 422->411 423->422 426 40863f-40865d fread 423->426 426->422 427 40865f-408666 426->427 428 408690-408692 427->428 429 408670-40868c memcmp 428->429 430 408694-4086ac 428->430 431 4086d0-4086e6 429->431 432 40868e 429->432 430->419 430->422 431->413 432->428
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freadfreemalloc
                                          • String ID:
                                          • API String ID: 2848089211-0
                                          • Opcode ID: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction ID: cab96f3465d474487508a1ec879676b61213e1df38a8e45f68965f676f42926a
                                          • Opcode Fuzzy Hash: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction Fuzzy Hash: 78413B716083118BC710DF29C58060FFBE1AFC8354F168E2EF9D897391EA79D8498B86
                                          Function 0040EFF6 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 433 40eff6-40effd 434 40f000-40f028 fsetpos fflush _fileno _filelengthi64 433->434 436 40efcd-40efd4 434->436
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _filelengthi64_filenofflushfsetpos
                                          • String ID:
                                          • API String ID: 1406207278-0
                                          • Opcode ID: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction ID: 1330b5d8d42a305a2191b976321c9ddfa34460ad39984d8d2968ac2a071300d9
                                          • Opcode Fuzzy Hash: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction Fuzzy Hash: 5BE0EDB2908B158BC700BF66A88119DFBE0FF80358F134C2FE4D953212E638A5D58B86
                                          Function 004066E0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 14COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: calloc
                                          • String ID: 0@$Cannot allocate memory for SPLASH_STATUS.$calloc
                                          • API String ID: 2635317215-3108904453
                                          • Opcode ID: 82d72ecdbd88522e30c842d19366d70def6be29cf6ee469c02a56ee1ccfb6e61
                                          • Instruction ID: 91d9d8c6ef22e38f4f1b4844de6a5a16a8ab255c7dc3ef68476b647e8a5c5417
                                          • Opcode Fuzzy Hash: 82d72ecdbd88522e30c842d19366d70def6be29cf6ee469c02a56ee1ccfb6e61
                                          • Instruction Fuzzy Hash: 0DD012B080E3008AC300AF21C15525E7AE4AF40704F85882EE5C557280D3BDC5959B8B
                                          Function 00401D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_wfopenfreemalloc
                                          • String ID: Failed to extract %s: failed to open archive file!
                                          • API String ID: 409134274-2950503014
                                          • Opcode ID: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                          • Instruction ID: 7614606d81e887eecfecfed5343dc5ca5952679920abc2288eb417914ad53e33
                                          • Opcode Fuzzy Hash: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                          • Instruction Fuzzy Hash: 93F01DB5A043059BDB00AF35E84419AB7E1BF80318F01893EE898DB391E738D8858B86
                                          Function 0040A090 Relevance: 5.1, APIs: 4, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: mallocmemcpy
                                          • String ID:
                                          • API String ID: 4276657696-0
                                          • Opcode ID: 02d46d53eafb68b30b763f551fb2a3305e08925e6983bdf89da9902f672765db
                                          • Instruction ID: 797d5049136f8a5f83aef3165c4761c57e8610ee519af45eb6e184e31c624f88
                                          • Opcode Fuzzy Hash: 02d46d53eafb68b30b763f551fb2a3305e08925e6983bdf89da9902f672765db
                                          • Instruction Fuzzy Hash: 23311371605B008FC354DF3AD68065BFBE2FB88354F41993ED48A87B50E675F8858B41
                                          Function 00407700 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wputenv_s.MSVCRT ref: 00407749
                                          • free.MSVCRT(?,?,?,00407AFF), ref: 00407754
                                          • free.MSVCRT(?,?,?,00407AFF), ref: 0040775C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ByteCharMultiWide_wputenv_s
                                          • String ID:
                                          • API String ID: 2386249605-0
                                          • Opcode ID: 66de1e51653dac200d6a456545627f4f8aa75ccab6a0350049436974a35eccfd
                                          • Instruction ID: 950e786cdc5d1bf19fb3b147057235cd525973657d6a811f6c43614b3b6a3ead
                                          • Opcode Fuzzy Hash: 66de1e51653dac200d6a456545627f4f8aa75ccab6a0350049436974a35eccfd
                                          • Instruction Fuzzy Hash: E3F0B7B1A093009BD700BF69E59975FBAE4EF84754F024D2EF4C897341D67988408B82
                                          Function 004017F4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ferrorfwrite
                                          • String ID: Failed to extract %s: decompression resulted in return code %d!
                                          • API String ID: 2451956730-2259475180
                                          • Opcode ID: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction ID: 3822a968a1abd095370c554b2ca83eb16347efd21d9f73064333f8d65a1dff39
                                          • Opcode Fuzzy Hash: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction Fuzzy Hash: 5AF01CB56097008BC710BF29E48105EBBE1FF81324F528A2EF5E897381D739D8818B86
                                          Function 00401124 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __wgetmainargs
                                          • String ID: B
                                          • API String ID: 1709950718-3394935788
                                          • Opcode ID: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction ID: 27c32f95ce735926b30c16c90320b224d17bcd53438576fbaefc61be872f07d1
                                          • Opcode Fuzzy Hash: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction Fuzzy Hash: 81E092B1A04711EFC714DF25E645246BBE0BB48308F81D91EE69897210D3B9A549DF8A
                                          Function 0040A3F0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID: 8
                                          • API String ID: 2803490479-4194326291
                                          • Opcode ID: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction ID: 3d9a3cba30c8a6cce76611aecb6f7ccedd9577938697bd5609853f48fc3db6fb
                                          • Opcode Fuzzy Hash: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction Fuzzy Hash: 542159B45083018FDB10DF29C5886267BE0AF48314F51866EA8499B3C5E3B8CC65CF47
                                          Function 00401D2C Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401610: malloc.MSVCRT ref: 00401679
                                            • Part of subcall function 00401610: malloc.MSVCRT ref: 0040168F
                                            • Part of subcall function 00401610: fread.MSVCRT ref: 004016F0
                                            • Part of subcall function 00401610: ferror.MSVCRT ref: 00401706
                                            • Part of subcall function 00401610: fwrite.MSVCRT ref: 0040178B
                                            • Part of subcall function 00401610: ferror.MSVCRT ref: 004017A3
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fcloseferrormalloc$freadfwrite
                                          • String ID:
                                          • API String ID: 2659978838-0
                                          • Opcode ID: ba584c84dcc7021ed2e9611c05d47d0ae0c51191637eb14f3cb18bd1de7ff9c6
                                          • Instruction ID: 2086b21a0a2fd9d0ee52b7dbb019afd7e35cf4cc68d36bcb5f0e3d1ef994c319
                                          • Opcode Fuzzy Hash: ba584c84dcc7021ed2e9611c05d47d0ae0c51191637eb14f3cb18bd1de7ff9c6
                                          • Instruction Fuzzy Hash: ADE01A75B043008BCB00AF29E84035AB7E1AF84354F06482EF888CB351D739D884CB95
                                          Function 004018B6 Relevance: 2.5, APIs: 2, Instructions: 19COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction ID: 37d18b623566974bb2935c6215979c875cfe96a297bc96d00919041d074b5ac9
                                          • Opcode Fuzzy Hash: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction Fuzzy Hash: 80E0E6B6604715CBCB107F65F48119DF7E0FF41328F124A3FE9E493291D639A5454B86
                                          Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wfopen.MSVCRT ref: 00404703
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide_wfopen
                                          • String ID:
                                          • API String ID: 372205238-0
                                          • Opcode ID: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction ID: 3468f0b4211825adde8639be08c033172f5b0e4316271c3a96c81e3ef559f4c6
                                          • Opcode Fuzzy Hash: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction Fuzzy Hash: 2FF0F2B04193009FC314FF28D58868EBBE8FF88348F018C2EF5C897252D6789549CB92
                                          Function 0040A4B1 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID:
                                          • API String ID: 2803490479-0
                                          • Opcode ID: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction ID: 34294cd6affbb3e785c4932bfc48d0f633533baf833ca0b38d678e79e0ec05fd
                                          • Opcode Fuzzy Hash: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction Fuzzy Hash: 87011EB45053018FDB54DF19C184356BBE0FF88304F55896EE8889B385D3B8C855CF46

                                          Non-executed Functions

                                          Function 00406D50 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 385libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc
                                          • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                          • API String ID: 190572456-2208601799
                                          • Opcode ID: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                          • Instruction ID: b9744897239d32f33dc6bfef900ed9271cf1591fb07702e628d33a7ecb5ec9b2
                                          • Opcode Fuzzy Hash: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                          • Instruction Fuzzy Hash: C3F108B090A701CBC7106F759A4506EBAF0AE41758F40CA3FB4A49B2C1DB7C9499DB9F
                                          Function 004086F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                          • WideCharToMultiByte.KERNEL32 ref: 00408787
                                          • GetLastError.KERNEL32(?,00402FD9), ref: 004087D0
                                          Strings
                                          • PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 004087FA
                                          • Failed to encode wchar_t as UTF-8., xrefs: 004087E0
                                          • WideCharToMultiByte, xrefs: 004087E8
                                          • No error messages generated., xrefs: 004087A8
                                          • FormatMessageW, xrefs: 004087B0
                                          • PyInstaller: FormatMessageW failed., xrefs: 004087C2
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharErrorFormatLastMessageMultiWide
                                          • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                          • API String ID: 1653872744-2573406579
                                          • Opcode ID: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                          • Instruction ID: e5d7e6b934a0c345d3486c1070e2a035779d45014a63eb974780677ace9c2cb0
                                          • Opcode Fuzzy Hash: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                          • Instruction Fuzzy Hash: 8B111AB45093018BE310AF69D54835BBAF0EB94389F50892EE4D49A285D7BD858C8BA7
                                          Function 004014F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 43libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$HandleLibraryLoadModule
                                          • String ID: , B$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                          • API String ID: 384173800-2541462354
                                          • Opcode ID: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                          • Instruction ID: 6c6c026f4a83c0f72c7764c329cd2c4586c53e905c616f5fc2452e48b3062107
                                          • Opcode Fuzzy Hash: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                          • Instruction Fuzzy Hash: 200175B1805304ABD700BF79AD4425ABFF4EB44399F02853FE98957260D7789848CB9F
                                          Function 00414570 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1456COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $ $9$Infinity$NaN
                                          • API String ID: 0-2156819404
                                          • Opcode ID: fb752ad01a167b7c3ce2d06964dcb0e38cd8f53d46aad30b3ca282ca9372ef33
                                          • Instruction ID: 135e34cb9ca9e985b4a278f7eb7425a40accb92fd251a454e4488a178f868c55
                                          • Opcode Fuzzy Hash: fb752ad01a167b7c3ce2d06964dcb0e38cd8f53d46aad30b3ca282ca9372ef33
                                          • Instruction Fuzzy Hash: 93D224B1A08781CFD720DF29C08479ABBE1BBC8354F15891EE89587351E779D885CF8A
                                          Function 004011B3 Relevance: 9.1, APIs: 6, Instructions: 119sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterSleepUnhandled__p__wcmdln_amsg_exit_inittermmemcpy
                                          • String ID:
                                          • API String ID: 527270645-0
                                          • Opcode ID: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                          • Instruction ID: 9529fa1fa00849a3a4482e99920bc3e8817caf8231a65d9ae2bb721758bc0f10
                                          • Opcode Fuzzy Hash: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                          • Instruction Fuzzy Hash: 45414DB4A043018FDB20EFA9D98475AB7F0FB44344F51453EE985A73B0DBB89845CB89
                                          Function 004131C0 Relevance: 7.9, Strings: 6, Instructions: 424COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$@$Inf$NaN$gfff$gfff
                                          • API String ID: 0-3155045678
                                          • Opcode ID: 649fb20abb9812e0e09aa82762c5c86987e6c960a3fbba0dce5609d8b374321b
                                          • Instruction ID: a46ccd9e596887ef7586e3f83d06ea90e66d5ef1390d3a99a1c477af4a84c032
                                          • Opcode Fuzzy Hash: 649fb20abb9812e0e09aa82762c5c86987e6c960a3fbba0dce5609d8b374321b
                                          • Instruction Fuzzy Hash: F3F1E5717083018BD7149F29C48429BB7E1BF84345F188A6FE899DB355D738DE85CB4A
                                          Function 00410A20 Relevance: 7.9, Strings: 6, Instructions: 424COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: .$@$Inf$NaN$gfff$gfff
                                          • API String ID: 0-3155045678
                                          • Opcode ID: dab502d568537ec720aaf45a7e0f9e0a341b1c2f8383f2d09a6fbb2e9003e841
                                          • Instruction ID: d384fdde2e77d5b6e892d09c38fe2caee72570f537571c461ee27f5ac1cb1202
                                          • Opcode Fuzzy Hash: dab502d568537ec720aaf45a7e0f9e0a341b1c2f8383f2d09a6fbb2e9003e841
                                          • Instruction Fuzzy Hash: 2EF1C7716083018BD7149E69C48469BB7D1BFC8314F148A2FF999DB345E7B8ECC58B8A
                                          Function 00401170 Relevance: 7.6, APIs: 5, Instructions: 135sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                          • Instruction ID: 683df0bb935b0ba919073670d03ce8182cb7faa8ee4b460d1895c998537b4a50
                                          • Opcode Fuzzy Hash: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                          • Instruction Fuzzy Hash: 0C5180B0A043019FDB20DFA8D984B5AB7F0FB44344F11453EE945AB3B1D7789845CB89
                                          Function 0040A670 Relevance: 7.0, Strings: 5, Instructions: 723COMMON
                                          Download Yara Rule
                                          Strings
                                          • invalid block type, xrefs: 0040C008
                                          • too many length or distance symbols, xrefs: 0040B5DB
                                          • incorrect data check, xrefs: 0040A858
                                          • invalid literal/length code, xrefs: 0040C139
                                          • invalid stored block lengths, xrefs: 0040AA6D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: incorrect data check$invalid block type$invalid literal/length code$invalid stored block lengths$too many length or distance symbols
                                          • API String ID: 0-817236767
                                          • Opcode ID: 732da43ed72cc2c4120bf8a60150f6b0ba1b7153d6323c3b09595d69c6cd98af
                                          • Instruction ID: b6d793466c67ffd8e3b1f57c4bb4f26a608bbcae03501d0a96c59416067c7ba4
                                          • Opcode Fuzzy Hash: 732da43ed72cc2c4120bf8a60150f6b0ba1b7153d6323c3b09595d69c6cd98af
                                          • Instruction Fuzzy Hash: 0C623B719183418FC754CF28C18462ABBF1FF88314F598A6EE999A7391D378E941CF86
                                          Function 0040AF90 Relevance: 6.8, Strings: 5, Instructions: 508COMMON
                                          Download Yara Rule
                                          Strings
                                          • invalid distances set, xrefs: 0040C77C
                                          • incorrect data check, xrefs: 0040A858
                                          • invalid literal/lengths set, xrefs: 0040C5EE
                                          • invalid bit length repeat, xrefs: 0040C659
                                          • invalid code -- missing end-of-block, xrefs: 0040BB65
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: incorrect data check$invalid bit length repeat$invalid code -- missing end-of-block$invalid distances set$invalid literal/lengths set
                                          • API String ID: 0-3719072575
                                          • Opcode ID: 87f7b0a5de183da02882c39e40a9c5277c9a1d09e12685698913540847143514
                                          • Instruction ID: 1cbbd36348c41b3311386e0b9d0a20f1b1c4d21bf7d9573915b1ba99331fb76a
                                          • Opcode Fuzzy Hash: 87f7b0a5de183da02882c39e40a9c5277c9a1d09e12685698913540847143514
                                          • Instruction Fuzzy Hash: C7221775A083418FC714CF18C48062ABBF1FF88714F198A2EE999A7391D775E941CF8A
                                          Function 00408F20 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Find$CloseFileFirst
                                          • String ID:
                                          • API String ID: 2295610775-0
                                          • Opcode ID: d88965ee97bb4822c6f5735e6fb7c0daf0eae884ec34d0cf24b004702f191101
                                          • Instruction ID: 704cf8f4e32a680898036105631b38574d231553fb3af9f17300ce401ba249f6
                                          • Opcode Fuzzy Hash: d88965ee97bb4822c6f5735e6fb7c0daf0eae884ec34d0cf24b004702f191101
                                          • Instruction Fuzzy Hash: 6CF0DA745183418BE710EFB4D54C31EBBE0BB84318F544E2DE8A9922E0E7BD8558CB87
                                          Function 004095E6 Relevance: .3, Instructions: 282COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ad0a953a7912c998d8460aa3cbf0d34e957a404584fcef4e55bd5703657de69d
                                          • Instruction ID: 0c18a3eff60174cb18f533cfcdf03bd16056950eb2d79401b90b41b69f56c1f0
                                          • Opcode Fuzzy Hash: ad0a953a7912c998d8460aa3cbf0d34e957a404584fcef4e55bd5703657de69d
                                          • Instruction Fuzzy Hash: 93B1B231A142648FC708EF2ED89416AB7F1EBC9311F068A7EE685D3391D335E906CB58
                                          Function 00409949 Relevance: .2, Instructions: 156COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c935b049c362aa1a63225b768a6dbc6fca87cb99015741649604f348b5fa66f8
                                          • Instruction ID: 2bdbe780b9e1ae2383d83eb5e7904df0d3d9205a4af587aec09da948086b2981
                                          • Opcode Fuzzy Hash: c935b049c362aa1a63225b768a6dbc6fca87cb99015741649604f348b5fa66f8
                                          • Instruction Fuzzy Hash: EC51C3717241604BCB08EE3EDCA4176B7E2E7C6302B5586BEE682C3795C739D902C758
                                          Function 004025E0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 234windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                          • String ID: $0$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                          • API String ID: 3223904152-2569830377
                                          • Opcode ID: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                          • Instruction ID: 2067da98e2504e100063f8f35cc28d01e2b4b69eff652bc710e7bd6244d7957c
                                          • Opcode Fuzzy Hash: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                          • Instruction Fuzzy Hash: B7C183B4909301DFE700EF68C19835ABFE0FB88354F10896EE8988B355D7B99548CF96
                                          Function 00403880 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 262COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                          • API String ID: 1294909896-4198433784
                                          • Opcode ID: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction ID: 6540644356b1fe9e7dd3889ac2da6173512776e99aae4954ed64b62622b12aad
                                          • Opcode Fuzzy Hash: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction Fuzzy Hash: 35B1C4B4608701DFC710AF29D58815ABBE4BF88355F41892EE9D9D3390DBB8C981CF5A
                                          Function 00405A60 Relevance: 28.6, APIs: 2, Strings: 17, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                          • free.MSVCRT ref: 00405C26
                                          • free.MSVCRT ref: 00405C34
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$EnvironmentVariable
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                          • API String ID: 471908985-4092346810
                                          • Opcode ID: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                          • Instruction ID: 22c84da25320057bd24c90e3ec615a054902b22b929e7a825a46e5f77c0d8298
                                          • Opcode Fuzzy Hash: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                          • Instruction Fuzzy Hash: B5513BB0609B009BE310AF65D54826BBBE0EF44354F458A2FE9D5A72D1C7BC8485CF9B
                                          Function 0040E660 Relevance: 25.7, APIs: 17, Instructions: 174COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                          • Instruction ID: 1138b9a49e69c7a07146da18e6cbb8f4c5af7b9e580f31b8634df38c7834fdfb
                                          • Opcode Fuzzy Hash: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                          • Instruction Fuzzy Hash: 036130709082119BCB10AF66C44536FBBE1EF94344F468D3FE488A7391E77C8891DB9A
                                          Function 00402B80 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 81windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                          • String ID: 8 $@$Unhandled exception in script
                                          • API String ID: 3963799495-1206599369
                                          • Opcode ID: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                          • Instruction ID: 5f7a7bfca591e00baa7cae047d41d3b5615dab244da7dd9e67f68e2e3487ae70
                                          • Opcode Fuzzy Hash: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                          • Instruction Fuzzy Hash: C231E5B05087409FD750EF69D48969FBBE4AF89348F428D2EE58897350DB78D488CB86
                                          Function 004077C0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                          • free.MSVCRT ref: 0040781A
                                            • Part of subcall function 00408FA0: wcslen.MSVCRT ref: 00408FAC
                                          • _wfullpath.MSVCRT ref: 0040784A
                                          • wcschr.MSVCRT ref: 00407877
                                          • wcsncpy.MSVCRT ref: 004078A7
                                          • CreateDirectoryW.KERNEL32 ref: 004078B7
                                          • wcschr.MSVCRT ref: 004078C7
                                          • CreateDirectoryW.KERNEL32 ref: 004078DD
                                          • _wcsdup.MSVCRT ref: 004078F3
                                          Strings
                                          • \, xrefs: 004078BF
                                          • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00407900
                                          • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00407920
                                          • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 0040792E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                          • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$\
                                          • API String ID: 274989731-3296995943
                                          • Opcode ID: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                          • Instruction ID: b23a07802ca04ce963d90eb9615f597fb6c60bb1e29e7f7f3b36ce21c54aa4ff
                                          • Opcode Fuzzy Hash: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                          • Instruction Fuzzy Hash: 1C315DB1A087018BD3107F69D94935FBAE4BF84344F05883EE9C897381DB79D8459B8B
                                          Function 00403370 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 220stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004032F0: strchr.MSVCRT ref: 0040332F
                                            • Part of subcall function 004032F0: strcpy.MSVCRT ref: 00403345
                                          • strcmp.MSVCRT ref: 0040351A
                                            • Part of subcall function 00407FD0: feof.MSVCRT ref: 00408033
                                            • Part of subcall function 00407FD0: fread.MSVCRT ref: 00408057
                                            • Part of subcall function 00407FD0: ferror.MSVCRT ref: 00408063
                                            • Part of subcall function 00407FD0: clearerr.MSVCRT ref: 00408074
                                            • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080B8
                                            • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$clearerrfeofferrorfreadstrchrstrcmpstrcpy
                                          • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$\
                                          • API String ID: 3546371548-4129990315
                                          • Opcode ID: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                          • Instruction ID: 8a7e982486c7dae7ba286fda290711f8ff69515a3f7b07f7f3724835a8bf7877
                                          • Opcode Fuzzy Hash: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                          • Instruction Fuzzy Hash: 67A126B0508701AFC710EF26C58415FBBE8BF84755F408A2EF498A7390D778DA858F8A
                                          Function 00403D60 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 316stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004021E0: calloc.MSVCRT ref: 004021F2
                                            • Part of subcall function 004045D0: GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                          • fclose.MSVCRT ref: 00404245
                                            • Part of subcall function 00404670: strcpy.MSVCRT(?,-00000004,?,00000002,?,00401600), ref: 00404683
                                            • Part of subcall function 00404670: strlen.MSVCRT ref: 0040468B
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                          • free.MSVCRT ref: 00403E26
                                            • Part of subcall function 00407770: SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040D7CA), ref: 0040779E
                                            • Part of subcall function 00407770: free.MSVCRT(?,?,-00000004,?,00000002,?,00401600), ref: 004077AC
                                          • SetDllDirectoryW.KERNEL32 ref: 00403EA2
                                          • strcmp.MSVCRT ref: 00403EDB
                                          • strcpy.MSVCRT ref: 00403F28
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: EnvironmentVariablefreestrcpy$DirectoryFileModuleNamecallocfclosestrcmpstrlen
                                          • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                          • API String ID: 3041748488-3602715111
                                          • Opcode ID: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                          • Instruction ID: 81834f9b1efb18d84d1230dad00edf6ea56ed27c7a1d01e0e46bb9e00272f83c
                                          • Opcode Fuzzy Hash: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                          • Instruction Fuzzy Hash: 0FD1F8B09097018AD710AF75D58425FBBE8AF84345F01893FE9D8A7381E738D985CF96
                                          Function 00405490 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 133COMMON
                                          Download Yara Rule
                                          Strings
                                          • Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00405697
                                          • pyi-, xrefs: 00405554
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
                                          • API String ID: 0-3625900369
                                          • Opcode ID: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                          • Instruction ID: 53111416b2da41d66908906ea93154b7d6de6c86b10f1f3900d8cec0b1898ba9
                                          • Opcode Fuzzy Hash: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                          • Instruction Fuzzy Hash: 33513CB05097009FD710AF65D98476ABBE0FB45304F82482EE8C8AB391D3BDD885CF5A
                                          Function 004019C0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                          • malloc.MSVCRT ref: 00401A0D
                                          • fread.MSVCRT ref: 00401A94
                                          • free.MSVCRT(?,?,?,?,0040638C,?,?,?,?,?,?,?,?,00000000,?,004040A4), ref: 00401ACF
                                          • fclose.MSVCRT ref: 00401AE5
                                          Strings
                                          • fread, xrefs: 00401AB5
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401B55
                                          • fseek, xrefs: 00401B7F
                                          • Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00401BA7
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401B73
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401AAD
                                          • malloc, xrefs: 00401BB2
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosefreadfreemalloc
                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                          • API String ID: 3295367466-3659356012
                                          • Opcode ID: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction ID: c4bf1cbcbd5ed2c421977dfe96b942ab9f05e938e4513c73373e5f6d25da3068
                                          • Opcode Fuzzy Hash: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction Fuzzy Hash: A25103B16093019FD700EF2AD49461BBBE4AF85744F05882EF988DB351E779D885CF8A
                                          Function 00405907 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                          • out of memory, xrefs: 00405A3A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$setlocale$_strdupcalloc
                                          • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                          • API String ID: 3058678114-3355598041
                                          • Opcode ID: 8e491d779bcae0e2072a8594eb7feea33e39b682cb57c9099b2df8bd6e9feec6
                                          • Instruction ID: 3c8cf5d1830a856620667b4546970957c4b2e71bcab9539e8d8fe080ce2f005d
                                          • Opcode Fuzzy Hash: 8e491d779bcae0e2072a8594eb7feea33e39b682cb57c9099b2df8bd6e9feec6
                                          • Instruction Fuzzy Hash: BD313AB16087118FD710AF69E58526FBBE0EF40318F06482EE9C497341E77DD885CB9A
                                          Function 00405C49 Relevance: 18.1, APIs: 2, Strings: 10, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                            • Part of subcall function 00408C20: calloc.MSVCRT ref: 00408C3D
                                            • Part of subcall function 00408C20: free.MSVCRT ref: 00408C88
                                            • Part of subcall function 00408C20: free.MSVCRT ref: 00408C96
                                          • free.MSVCRT ref: 00405C26
                                          • free.MSVCRT ref: 00405C34
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ByteCharMultiWidecalloc
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$\$\$base_library.zip$lib-dynload
                                          • API String ID: 3975185072-2560864920
                                          • Opcode ID: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                          • Instruction ID: 4f34d637e5975f622271dbaeae991fb6a0a455f2055f84ceed78d6860252850e
                                          • Opcode Fuzzy Hash: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                          • Instruction Fuzzy Hash: EF414AB0609711DFE310AF21E94825BBBE4FF48344F41882EE9C997390D7B89586CF5A
                                          Function 00402370 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 145COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                          • String ID: P%
                                          • API String ID: 2147705588-2959514604
                                          • Opcode ID: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                          • Instruction ID: ab84631f0651d0ee5a96381c4044ee0ed1be7ca295fb525e9842aa76770568ef
                                          • Opcode Fuzzy Hash: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                          • Instruction Fuzzy Hash: FE51F8B19083108FC714EF29D58826ABBF0BF88711F45897EFC898B356E7788544DB62
                                          Function 0040D980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Address %p has no image-section, xrefs: 0040DB2B
                                          • VirtualProtect failed with code 0x%x, xrefs: 0040DAE6
                                          • Mingw-w64 runtime failure:, xrefs: 0040D9A8
                                          • VirtualQuery failed for %d bytes at address %p, xrefs: 0040DB17
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: QueryVirtualabortfwritevfprintf
                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                          • API String ID: 2513968241-1534286854
                                          • Opcode ID: 5c2ecd956853b343dac6192357bd0367a738e9911806a7d503f452befc2f41a7
                                          • Instruction ID: 12c366034f147c51322be65863a430c13289ac5cb36f6d5ee6a9828dd919d681
                                          • Opcode Fuzzy Hash: 5c2ecd956853b343dac6192357bd0367a738e9911806a7d503f452befc2f41a7
                                          • Instruction Fuzzy Hash: C7514EB19083018FC710EF69D88565BFBF0FF84354F45896EE88997255E738E844CB9A
                                          Function 004061B0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 143stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Cannot allocate memory for necessary files., xrefs: 0040639F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: memcpystrncpy$malloc$callocfreestrlenstrncat
                                          • String ID: Cannot allocate memory for necessary files.
                                          • API String ID: 1441568290-2795144771
                                          • Opcode ID: 7c9ef0ba816273b896b145fc103824cdb55597e19d7904a55412be52107c55ef
                                          • Instruction ID: 3dc4d87da5770e9ddebe32c392722ba7e048c8290a166a4e568edb3e8c8cc1ad
                                          • Opcode Fuzzy Hash: 7c9ef0ba816273b896b145fc103824cdb55597e19d7904a55412be52107c55ef
                                          • Instruction Fuzzy Hash: F35105B16093018FC714EF65C08469ABBE4FF88314F12892EE9C997351E778E588CB86
                                          Function 00406410 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • SPLASH: Cannot find requirement %s in archive., xrefs: 0040653D
                                          • SPLASH: Cannot extract requirement %s., xrefs: 00406629
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlenstrncpy$callocfreememcpystrcmp
                                          • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
                                          • API String ID: 1148940474-4094522769
                                          • Opcode ID: 0fe46789b0fddc5af01da26119ed087f378fa1ebee96805bf033b37bb594d0e1
                                          • Instruction ID: eeb11d6563064941a90a30efff23fdfd712fb47c201b2447917d1c532d445a23
                                          • Opcode Fuzzy Hash: 0fe46789b0fddc5af01da26119ed087f378fa1ebee96805bf033b37bb594d0e1
                                          • Instruction Fuzzy Hash: 8B51E4B05097059FC324EF25D58529FFBE0BF84744F02882EEAC997352D7789884DB96
                                          Function 00405AA1 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 86COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$\$\$base_library.zip$lib-dynload
                                          • API String ID: 1294909896-729638271
                                          • Opcode ID: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                          • Instruction ID: 1f7a57bb88f92124875474453c602a743d3be9c2356b80e19fcfa62188903238
                                          • Opcode Fuzzy Hash: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                          • Instruction Fuzzy Hash: A74139B06097109FE310AF20E94825BBBE0FF44344F81882EE9C997390D7B89485CF5A
                                          Function 00407FD0 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004046B0: _wfopen.MSVCRT ref: 00404703
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                            • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                            • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                          • feof.MSVCRT ref: 00408033
                                          • fread.MSVCRT ref: 00408057
                                          • ferror.MSVCRT ref: 00408063
                                          • clearerr.MSVCRT ref: 00408074
                                          • fwrite.MSVCRT ref: 00408093
                                          • ferror.MSVCRT ref: 0040809F
                                          • clearerr.MSVCRT ref: 004080B0
                                          • fclose.MSVCRT ref: 004080B8
                                          • fclose.MSVCRT ref: 004080C0
                                          • fclose.MSVCRT ref: 004080E3
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosestrlen$clearerrferrorstrtok$_wfopen_wstatfeoffreadfwritestrcpy
                                          • String ID:
                                          • API String ID: 3104166669-0
                                          • Opcode ID: 5129a295bf3d7465ed589c74a8b46aec7613a5adb7438a7249500ed6fb567e41
                                          • Instruction ID: e6213c5d7688b8fe1ba8341ac8fdb9db29b335e178dc78efa11f235658ae9a09
                                          • Opcode Fuzzy Hash: 5129a295bf3d7465ed589c74a8b46aec7613a5adb7438a7249500ed6fb567e41
                                          • Instruction Fuzzy Hash: 6C2110716087518AD7107F2696812AFB6E4AF84354F07493FE8D4A73C1DB7DC889CB8A
                                          Function 00411E60 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: %*.*s$%-*.*s$%.*s
                                          • API String ID: 0-4054516066
                                          • Opcode ID: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                          • Instruction ID: 34a7cfded508d75713a3901c6ba7bdf4e42489cc40e2d4f26330675e440d4311
                                          • Opcode Fuzzy Hash: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                          • Instruction Fuzzy Hash: D74140B16047018BDB148F28C5C5696B7E1BF84354F25866EEE898F36AD339D8C2CB49
                                          Function 00408810 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00408CF4), ref: 0040885C
                                          • calloc.MSVCRT ref: 00408875
                                          • WideCharToMultiByte.KERNEL32 ref: 004088B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                          • API String ID: 1374691127-3831141058
                                          • Opcode ID: 4e764323b5da6069393867320cfaeab9384a8b5dfa5186b5e5608e1b5eb85b1a
                                          • Instruction ID: 5afcbffd29298bee6e331de86764b825c866944575c44242363fe351b07975aa
                                          • Opcode Fuzzy Hash: 4e764323b5da6069393867320cfaeab9384a8b5dfa5186b5e5608e1b5eb85b1a
                                          • Instruction Fuzzy Hash: 8521F5B15093059FD310AF66D64835BBBE4EB90358F00892EE4D85B281DBB984889BDB
                                          Function 00408920 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                          • calloc.MSVCRT ref: 004089EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                          • API String ID: 1374691127-27947307
                                          • Opcode ID: ec57b2630a86b51e236bb9ae246de2d1d3647b443b0b6df9a08948982de9e88b
                                          • Instruction ID: 392d32d0dc93c970adbdd4bd206061dd84090e66cdb548403919dc1ed5805d2f
                                          • Opcode Fuzzy Hash: ec57b2630a86b51e236bb9ae246de2d1d3647b443b0b6df9a08948982de9e88b
                                          • Instruction Fuzzy Hash: B021E7B01093028BD310AF66D55831BBAE4EF94758F00892EE4E4572D0D7B9D989DB97
                                          Function 00408374 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • LOADER: failed to strdup argv[%d]: %s, xrefs: 0040840A
                                          • LOADER: failed to allocate argv_pyi: %s, xrefs: 0040842D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errnostrerror$_strdupcalloc
                                          • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                          • API String ID: 4278403329-2782260415
                                          • Opcode ID: 862b9698239ebce43a11a1cd65b9d3759b7cedee0f2de4c3e769b3fa45a04455
                                          • Instruction ID: 75a4103835d43aa6c95cb7ec3b6db505b02a0d5b0f758bc2d410c1ae15a23f9c
                                          • Opcode Fuzzy Hash: 862b9698239ebce43a11a1cd65b9d3759b7cedee0f2de4c3e769b3fa45a04455
                                          • Instruction Fuzzy Hash: 0A2179B4904711CFC720AF75D94419ABBE0EB45314F514A7EE894A33A1E739E881CB9A
                                          Function 004055C3 Relevance: 13.5, APIs: 9, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setbuf$_fileno_setmodefflush
                                          • String ID:
                                          • API String ID: 1650367497-0
                                          • Opcode ID: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                          • Instruction ID: 4513b405083115c81ca635af3cf8f4969db3efee2aa6dccd88a9e4f4ed2810d7
                                          • Opcode Fuzzy Hash: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                          • Instruction Fuzzy Hash: CB1120B15097108BD7007FB5D59936EBBE0BF45314F83481DD4C897241EBBD94848B9A
                                          Function 0040DE30 Relevance: 12.1, APIs: 8, Instructions: 90COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: signal
                                          • String ID:
                                          • API String ID: 1946981877-0
                                          • Opcode ID: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                          • Instruction ID: 529314676596798a44e2e7d48aea7ed491276213eefa766ee39382917f2d3c55
                                          • Opcode Fuzzy Hash: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                          • Instruction Fuzzy Hash: DD3103B09056018AD7206FB8C84432F76D0AF55728F128A2FE4E5DB3D1DB7DD888979B
                                          Function 00407BC0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • wcscpy.MSVCRT ref: 00407C07
                                          • wcslen.MSVCRT ref: 00407C0F
                                          • wcscat.MSVCRT ref: 00407C39
                                          • _wfindfirst.MSVCRT ref: 00407C4C
                                          • _wrmdir.MSVCRT ref: 00407C68
                                          • wcscat.MSVCRT ref: 00407CDE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcscat$ByteCharMultiWide_wfindfirst_wrmdirwcscpywcslen
                                          • String ID:
                                          • API String ID: 955055573-0
                                          • Opcode ID: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                          • Instruction ID: 812287d127834224555eaebaea1a5f31319f6ec07a572a1decaabcd838263556
                                          • Opcode Fuzzy Hash: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                          • Instruction Fuzzy Hash: 572117B490D3049BD720AF75D88869EBBE4FB84304F118C3EE9C993251E7389585DB9B
                                          Function 00408B00 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                          • calloc.MSVCRT ref: 00408BAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                          • API String ID: 1374691127-876015163
                                          • Opcode ID: 49be66ffc8d7871a7cc8f30d3a32206120fe137de5c71585d33270cfb99dfb38
                                          • Instruction ID: 686223d8df53a97fa17e1b733178636a5c74384edd7780f85d5042dc75bc6c3c
                                          • Opcode Fuzzy Hash: 49be66ffc8d7871a7cc8f30d3a32206120fe137de5c71585d33270cfb99dfb38
                                          • Instruction Fuzzy Hash: AD2118B05083059FD310AF65C64925ABBF4EB84754F04893EE5E8572C1DBB8D8449B9B
                                          Function 004124D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 406COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputwc$memset
                                          • String ID: 0$o
                                          • API String ID: 822753988-4157579757
                                          • Opcode ID: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                          • Instruction ID: b65a98287eddb54592c783ac7525ef4ab93ad80493cd3b98cbaa9a691208da40
                                          • Opcode Fuzzy Hash: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                          • Instruction Fuzzy Hash: 79F16F71E102198FDB14CF68C6942DEBBF1BF44310F15822AE865EB385D778E892CB94
                                          Function 0040F730 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputc$memset
                                          • String ID: 0$o
                                          • API String ID: 2944404495-4157579757
                                          • Opcode ID: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                          • Instruction ID: 9062061d76251826460344fe4ffb90a7e4f33a362718e540e131347e649c7f22
                                          • Opcode Fuzzy Hash: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                          • Instruction Fuzzy Hash: 2BF14D72E002199FDB24DF68D49069EBBB1BF84310F15817AE859BB785D338E946CF84
                                          Function 00406A75 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                          • API String ID: 1294909896-1126984729
                                          • Opcode ID: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                          • Instruction ID: 5837fc7092d7bfd19bff1a36fcf45920a7a04ffe6dc7564dff579a9c2d03099d
                                          • Opcode Fuzzy Hash: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                          • Instruction Fuzzy Hash: 3A61F9B8609301CFD710AF64D48821ABBF0FF49344F81897DE9859B350D7B99859CF2A
                                          Function 00411A40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: %-*.*S$%.*S
                                          • API String ID: 0-812388239
                                          • Opcode ID: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                          • Instruction ID: c23151172c0a1ec719629ee0893607804d1b15add0b79fb5692203c1bf32c755
                                          • Opcode Fuzzy Hash: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                          • Instruction Fuzzy Hash: 7D4196B1A097159BC7109F29D4812DEBBE0AF84794F14C52FE5488B361E33DD9C1CB8A
                                          Function 00405CF0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 72stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freestrlen
                                          • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
                                          • API String ID: 322734593-985300917
                                          • Opcode ID: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction ID: b798077ea826a97b31ed519bc33854408a60d385b89e575b30205180b7c9f22a
                                          • Opcode Fuzzy Hash: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction Fuzzy Hash: 692117B0219B009BC7207F25D98856BBBE4FE80750F45892FE4C997291D7789482DF6B
                                          Function 0040E9C1 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freembstowcssetlocalewcstombs$realloc
                                          • String ID:
                                          • API String ID: 2323685431-0
                                          • Opcode ID: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                          • Instruction ID: 0ece9848e1b9cb63aa0c7ac93180fa40d32587a4740361e1b5221defc5654884
                                          • Opcode Fuzzy Hash: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                          • Instruction Fuzzy Hash: BA3129B09083159ECB10AF66C1452AEFBF0FF48344F51882FE888A7350E7789995CB86
                                          Function 00403446 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 58stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strcmp
                                          • String ID: %s%c%s%c%s%c%s$%s%c%s.pkg$Failed to extract %s$\$\$\
                                          • API String ID: 1004003707-2076181140
                                          • Opcode ID: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                          • Instruction ID: 73055d119674c1d8bf47e55e1769eeb00a0baa58503b6758db3226280ebf56de
                                          • Opcode Fuzzy Hash: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                          • Instruction Fuzzy Hash: 602128B1508701ABD7109F25C54414AFBE8BF80719F418D2EE5A8A7390D378EA45CF8A
                                          Function 00407CF0 Relevance: 10.6, APIs: 7, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcscmp$wcscat
                                          • String ID:
                                          • API String ID: 545343207-0
                                          • Opcode ID: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                          • Instruction ID: 66d593373b9ba32e9ef8b9ba0102b03e4299b10aa04248f83024a0eb22297dfe
                                          • Opcode Fuzzy Hash: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                          • Instruction Fuzzy Hash: B5113DB140C7458AD710BF2599842AFBAE4AF50344F02583EE9C597245EB7CA4868B9B
                                          Function 00405E00 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen
                                          • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                          • API String ID: 39653677-2762566162
                                          • Opcode ID: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                          • Instruction ID: 2414ad3c8f8d3fc0fbc978f46c10fd6a42ce83d48acf707811ed1e666cf8afaa
                                          • Opcode Fuzzy Hash: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                          • Instruction Fuzzy Hash: 6A112EB05093009FC710AF69DA8801EBBE4FF84354F45882EE5D897341D7B88481CF9B
                                          Function 00417510 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$HandleModule
                                          • String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
                                          • API String ID: 667068680-1145701848
                                          • Opcode ID: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                          • Instruction ID: 1b2e568be5773464d0952ec9ee83d8ba760180256f55db537a2820630d2abbb3
                                          • Opcode Fuzzy Hash: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                          • Instruction Fuzzy Hash: E1F049B0848204ABD700AF38AD4418A7EF0AA08314F15863FC889C7210E778D888CBAA
                                          Function 0040ED40 Relevance: 9.2, APIs: 6, Instructions: 158stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _stat$freemallocmemcpystrlen
                                          • String ID:
                                          • API String ID: 2821670080-0
                                          • Opcode ID: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                          • Instruction ID: c5bd95b142fc711015b6ce962a46217c3aa773e4d5f7f4cf9c825846a95b2092
                                          • Opcode Fuzzy Hash: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                          • Instruction Fuzzy Hash: 5B5173715093058FC724DF2AC08026BBBE2AF89304F454D6FE8E49B385D339D956DB8A
                                          Function 0040FCE0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 0
                                          • API String ID: 0-4108050209
                                          • Opcode ID: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                          • Instruction ID: 433f201fbec311e4d545196cfb57db08f817b2de0d536de69a62510c51185dfe
                                          • Opcode Fuzzy Hash: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                          • Instruction Fuzzy Hash: 46C15D71A042058FDB24CF68C48079EBBF1BF89354F18817AE849AB796D339EC45CB95
                                          Function 00412A90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 0
                                          • API String ID: 0-4108050209
                                          • Opcode ID: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                          • Instruction ID: 5dacb983aef9c9090e06cba1bb9e4627a9a1d687151f3e630a54116cb97c77b1
                                          • Opcode Fuzzy Hash: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                          • Instruction Fuzzy Hash: ABC15C71A042058BDB14CF28C6847DEBBF1BF88340F19855AE949EB355E378EC91CB99
                                          Function 00407564 Relevance: 8.8, APIs: 7, Instructions: 77stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$malloc
                                          • String ID:
                                          • API String ID: 3157260142-0
                                          • Opcode ID: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                          • Instruction ID: 6a25df0a465119ab13b362e17adcb34b3197186f0404beced398dc7aaf439a95
                                          • Opcode Fuzzy Hash: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                          • Instruction Fuzzy Hash: B5217175A0A7059BC710AF6988846ABB7E0FF84750F46493EF8C497341FA39EC41C796
                                          Function 00403030 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _errno.MSVCRT ref: 00403064
                                          • strerror.MSVCRT ref: 0040306F
                                            • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Message_errnostrerror
                                          • String ID: %s%s: %s$0$Fatal error detected
                                          • API String ID: 132859757-319980707
                                          • Opcode ID: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                          • Instruction ID: e4a221d579113a631f8ff3878a8ccab0824710bde975c9094fb448246fb893e6
                                          • Opcode Fuzzy Hash: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                          • Instruction Fuzzy Hash: 540180B4409345DFC750EF65D18464ABBE0FF88749F408C2EE4C897251EB789948DF96
                                          Function 00402A70 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DialogLongWindow$InvalidateRect
                                          • String ID:
                                          • API String ID: 1200242243-0
                                          • Opcode ID: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                          • Instruction ID: 27a3fa5a97dc3583b937ce51c481d096ba8d8761c7d493d8dec02a740509071e
                                          • Opcode Fuzzy Hash: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                          • Instruction Fuzzy Hash: 1A2160715082108FD310AF2CDA8925EBBE0FB84704F01893EF88A973D5D7B98949CB97
                                          Function 004038E1 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: %s%c%s.py$\$__file__$_pyi_main_co
                                          • API String ID: 1294909896-1862493962
                                          • Opcode ID: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction ID: c970f6cc1162f0d106d27565064d24bae80cc5d647643b18d1f9b1af61abd66d
                                          • Opcode Fuzzy Hash: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction Fuzzy Hash: 58219BB4909701EFC710AF24C18865ABFE4BF88745F41892EE8C993350E7B8D985DF4A
                                          Function 0040EA58 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                          • Instruction ID: e696c5700d6393410b77d795bc353bc03d311abb2f38c8898df76e4b882a8a07
                                          • Opcode Fuzzy Hash: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                          • Instruction Fuzzy Hash: 7C01D6B19093159FCB00AF65D64529EFBF0FF44344F12886EE488A7251E3789985CBCA
                                          Function 0040E887 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                          • Instruction ID: 3383cd8d3157cb3ed617c2d5b5c50993071427c57053a183d1f18b1378754ef2
                                          • Opcode Fuzzy Hash: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                          • Instruction Fuzzy Hash: 3DF0ECB19093009FCB40AF69D44529EFBE0EF84344F02CD6EE4D897211E7789895CB86
                                          Function 0040807B Relevance: 7.5, APIs: 5, Instructions: 26fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: clearerrfcloseferror$feoffreadfwrite
                                          • String ID:
                                          • API String ID: 2607417955-0
                                          • Opcode ID: e23c38ce40b9de981818dbabdb75aa260bd4a35cb26f3327470fa7c9e50a8650
                                          • Instruction ID: 6caf015234ffb0fe8031e1673ea91487ed83400b7f12cc8799a42872fabf3f27
                                          • Opcode Fuzzy Hash: e23c38ce40b9de981818dbabdb75aa260bd4a35cb26f3327470fa7c9e50a8650
                                          • Instruction Fuzzy Hash: D3E0AC71609B104AD3107F26A58116EF6E4AF80354F07492FE8E497291D77DC4C58B86
                                          Function 004045D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                            • Part of subcall function 00408920: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                          Strings
                                          • Failed to convert executable path to UTF-8., xrefs: 00404650
                                          • GetModuleFileNameW, xrefs: 00404638
                                          • Failed to get executable path., xrefs: 00404630
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharFileModuleMultiNameWide
                                          • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                          • API String ID: 1532159127-1977442011
                                          • Opcode ID: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                          • Instruction ID: 0d2fa86ab14f13f7fcc6e2807861f5dff99018acd92cf068427be3d6d0997f9d
                                          • Opcode Fuzzy Hash: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                          • Instruction Fuzzy Hash: 7FF031B09083008BE700BF75D14925ABAE0AB94345F548C3EE8C887285E77E85989697
                                          Function 00408987 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                            • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                          • calloc.MSVCRT ref: 004089EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLastcalloc
                                          • String ID: Out of memory.$win32_utils_to_utf8
                                          • API String ID: 2784544953-3983694475
                                          • Opcode ID: 23ce19d6e8e5e968e1a14f6c08f0706b24b70b9de6d2737a880b3ae8fbfb5caf
                                          • Instruction ID: 7d0191ab155d1c36bf02162991644b0c6808e0cf9adbb8e4045d17a736bf9196
                                          • Opcode Fuzzy Hash: 23ce19d6e8e5e968e1a14f6c08f0706b24b70b9de6d2737a880b3ae8fbfb5caf
                                          • Instruction Fuzzy Hash: 5D0119B01083028FE310AF65D55835ABBE0EB80358F01893EE4E85B3D0D7B9C5498B87
                                          Function 004174C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: atoisetlocalestrchr
                                          • String ID: .
                                          • API String ID: 1223908000-248832578
                                          • Opcode ID: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                          • Instruction ID: 5ece903d628136d3021f03f5de1dba085c6daeff515edd77d6e3c8bfb4f9f80e
                                          • Opcode Fuzzy Hash: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                          • Instruction Fuzzy Hash: 18E08CB0A087004BD7007F39C40A35BB6E2AB80308F8A882CE4CC87701F73DC8858786
                                          Function 00404DA3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$ErrorLast
                                          • String ID: Failed to get address for Py_UTF8Mode$GetProcAddress$Py_UTF8Mode
                                          • API String ID: 4214558900-2336683375
                                          • Opcode ID: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                          • Instruction ID: 29490028243a8bc7eb143a8c508494385d0dcc63e20c03701c217239cd601c8a
                                          • Opcode Fuzzy Hash: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                          • Instruction Fuzzy Hash: B7E0ECB18096108AC7106F39AA5519ABBE4BA4072CF018A2EE998572C0D778A985968E
                                          Function 00416DF0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          • IsDBCSLeadByteEx.KERNEL32 ref: 00416E42
                                          • MultiByteToWideChar.KERNEL32 ref: 00416E85
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$CharLeadMultiWide
                                          • String ID:
                                          • API String ID: 2561704868-0
                                          • Opcode ID: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                          • Instruction ID: 73686868ec51103a6e9184972a812ecf3e9551738ac5fc900f4de2194f72883f
                                          • Opcode Fuzzy Hash: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                          • Instruction Fuzzy Hash: 6441F5B55093518FD710DF28E48429BBBE0BF86314F158A6EF89487390D77AD889CB87
                                          Function 00401001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __p__commode__p__fmode__set_app_type
                                          • String ID:
                                          • API String ID: 3338496922-0
                                          • Opcode ID: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                          • Instruction ID: aeb446e45a19cd1e2d7087c0f9dd5afe65501be8eb4055b43830eca8bb231281
                                          • Opcode Fuzzy Hash: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                          • Instruction Fuzzy Hash: 2B219370600201CBD314AF30D8667A737E1BB00348F55867ED4887BAA6D77ED8C6DB99
                                          Function 004043B0 Relevance: 6.1, APIs: 4, Instructions: 54stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlenstrncat
                                          • String ID:
                                          • API String ID: 3854678441-0
                                          • Opcode ID: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                          • Instruction ID: a1bd85adc18dd833a72da197840ca80eebc8a3fb90e726dddcfc8ac31c193ccc
                                          • Opcode Fuzzy Hash: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                          • Instruction Fuzzy Hash: 431154B160C7404EE710BF2DE88935FBBD0EB85358F064DAFE5C457346D27984848B96
                                          Function 00402CE0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • free.MSVCRT ref: 00402D67
                                          • free.MSVCRT ref: 00402D6F
                                          • free.MSVCRT ref: 00402D77
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          Strings
                                          • Failed to obtain/convert traceback!, xrefs: 00402D2F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ByteCharMultiWide
                                          • String ID: Failed to obtain/convert traceback!
                                          • API String ID: 3219091393-982972847
                                          • Opcode ID: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                          • Instruction ID: b1da0bbaf139879325ca28b011b54c10ba95b71f8749f1078afd24c14b703eba
                                          • Opcode Fuzzy Hash: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                          • Instruction Fuzzy Hash: 380157B16097009BD700BF6A959531FFAE4AF84744F06482EF8C897381DBB898458B9A
                                          Function 0040E7F1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                          • Instruction ID: d41dfc4cb9d2f32e5806314ff69e05ab86441aac7deb837ed49f13012e92ac7c
                                          • Opcode Fuzzy Hash: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                          • Instruction Fuzzy Hash: 35012971E04714DBCB109F69D44139EFBF0FF88314F12896EE499A7391D37898518B96
                                          Function 0040598B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$setlocale
                                          • String ID: Fatal error: unable to decode the command line argument #%i
                                          • API String ID: 294139027-810459673
                                          • Opcode ID: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                          • Instruction ID: f47e09dd697b96e2b59eaf830e36c8aa388eac640d0f1e900355e8c5eb1699ce
                                          • Opcode Fuzzy Hash: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                          • Instruction Fuzzy Hash: 86011DB5A047018FDB10AF69E88526ABBE0EF05314F46093EE9C4A7341D33DE8858B99
                                          Function 00408B57 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                            • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                          • calloc.MSVCRT ref: 00408BAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLastcalloc
                                          • String ID: Out of memory.$win32_utils_from_utf8
                                          • API String ID: 2784544953-2800126769
                                          • Opcode ID: faa07458aa00f100ca5af6febbccce1ab187ecf5489320c22ac0fd242ec8e11b
                                          • Instruction ID: fcbae36c43b134958f39cc4fef673158ef90f98619c8ac1ec6a6b109632cf1fa
                                          • Opcode Fuzzy Hash: faa07458aa00f100ca5af6febbccce1ab187ecf5489320c22ac0fd242ec8e11b
                                          • Instruction Fuzzy Hash: F7F04FB01083028FD300AF25D50535AB7E0BB80354F05893EE4E85B281D779D4498B86
                                          Function 00402F90 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32 ref: 00402F98
                                            • Part of subcall function 004086F0: FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                            • Part of subcall function 004086F0: WideCharToMultiByte.KERNEL32 ref: 00408787
                                            • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Message$ByteCharErrorFormatLastMultiWide
                                          • String ID: %s%s: %s$0$Fatal error detected
                                          • API String ID: 254840284-319980707
                                          • Opcode ID: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                          • Instruction ID: 073ad40fe3aa3b4c51d3ea82456dca4d4efc994dc50aa159961d7af2ea3959c7
                                          • Opcode Fuzzy Hash: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                          • Instruction Fuzzy Hash: 3E01C0B14093419FD320AF29D58428ABBE0BF88708F01882EE4C897251DB789988CF97
                                          Function 0040DB40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON
                                          Download Yara Rule
                                          Strings
                                          • Unknown pseudo relocation bit size %d., xrefs: 0040DC4C
                                          • Unknown pseudo relocation protocol version %d., xrefs: 0040DDAD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                          • API String ID: 0-395989641
                                          • Opcode ID: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                          • Instruction ID: 5a79fb0c569983318be0eb92f73853d4612fcc90bcd5073555eddd72529e42a9
                                          • Opcode Fuzzy Hash: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                          • Instruction Fuzzy Hash: E271B175D042058BDB00DFA9D88029ABBF1FFC4344F25857AD888A7395D738A859CB8D
                                          Function 004124C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputwc$memset
                                          • String ID: o
                                          • API String ID: 822753988-252678980
                                          • Opcode ID: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                          • Instruction ID: 0dfbfd20a5ff8b44feb81e2e93b8d7a761d81825f22629ca31478565f12853d3
                                          • Opcode Fuzzy Hash: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                          • Instruction Fuzzy Hash: 5B61F572E002198FCB14CF68D5806DEBBF1AF48350F19816AE858EB385D374E9968B94
                                          Function 0040D8E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Unknown error, xrefs: 0040D8E2
                                          • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040D92F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fprintf
                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                          • API String ID: 383729395-3474627141
                                          • Opcode ID: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                          • Instruction ID: d090ae441ae7ed191b2c3bbd373a08a5730f8df06674ae97c57d609341765c89
                                          • Opcode Fuzzy Hash: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                          • Instruction Fuzzy Hash: DD01E4B0508B85DBD300AF15E48845AFFF1FF89350F82889DF5C846269CB36D8A8C74A
                                          Function 00415E10 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E37
                                          • InitializeCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E74
                                          • InitializeCriticalSection.KERNEL32(?,?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E80
                                          • EnterCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415EA8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CriticalSection$Initialize$EnterSleep
                                          • String ID:
                                          • API String ID: 1117354567-0
                                          • Opcode ID: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                          • Instruction ID: 8d4cea6e3eae5d5154d2418d5b7341923ef78fd17797a7ba2a2094ec0acf5e62
                                          • Opcode Fuzzy Hash: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                          • Instruction Fuzzy Hash: FC113771804604CBDB65AB2CE9D51EF37A4F740300F652636D445C7324E779D9C8C69E
                                          Function 0040DFE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040DFEE
                                          • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E015
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E01C
                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E03C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                          • String ID:
                                          • API String ID: 682475483-0
                                          • Opcode ID: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                          • Instruction ID: ec43abde3d5bb8c9cd3b17ef075de6dc33701065addaa06d31121f0b361238c5
                                          • Opcode Fuzzy Hash: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                          • Instruction Fuzzy Hash: 6FF028B55003118BD710BF79E8C890B7BF4EB04740F0505B9DD848B325E774AC19CBAA
                                          Function 00406720 Relevance: 5.0, APIs: 4, Instructions: 29COMMON
                                          Download Yara Rule
                                          APIs
                                          • free.MSVCRT(-00000004,?,00000002), ref: 0040673C
                                          • free.MSVCRT(-00000004,?,00000002), ref: 0040674E
                                          • free.MSVCRT(-00000004,?,00000002), ref: 00406760
                                          • free.MSVCRT(-00000004,?,00000002), ref: 00406768
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.3893349678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.3893266687.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893503379.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893615514.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893691862.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.3893791765.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                          • Instruction ID: 7fa97c1622dad13d69692f5ac932c0fb64940c2aa2579b211d90da9c96ec3935
                                          • Opcode Fuzzy Hash: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                          • Instruction Fuzzy Hash: 34F0FEB56143004BDF20BF35B4C565A7BE4AF00748F4B087DED85AB242E738D8908B69

                                          Execution Graph

                                          Execution Coverage:0.5%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:0%
                                          Total number of Nodes:369
                                          Total number of Limit Nodes:28
                                          execution_graph 56476 404300 56477 40430b 56476->56477 56484 4042d0 56477->56484 56480 40436b 56483 4042d0 3 API calls 56483->56480 56507 40f100 56484->56507 56486 4042f7 56486->56480 56487 40e900 setlocale 56486->56487 56488 40e923 _strdup 56487->56488 56489 40e92d setlocale 56487->56489 56488->56489 56490 40e950 wcstombs realloc wcstombs setlocale free 56489->56490 56491 40e948 56489->56491 56493 404348 56490->56493 56491->56490 56492 40e9c8 mbstowcs 56491->56492 56516 40e630 56492->56516 56493->56483 56496 40ea42 56498 40ea6e 56496->56498 56500 40ea80 56496->56500 56497 40ea21 56497->56496 56499 40ec55 setlocale free 56497->56499 56498->56490 56499->56493 56501 40eae1 wcstombs realloc wcstombs 56500->56501 56506 40eb70 wcstombs 56500->56506 56503 40eb4e setlocale free 56501->56503 56503->56493 56505 40ecc2 56505->56503 56506->56503 56506->56505 56508 40f150 56507->56508 56509 40f119 56507->56509 56515 411040 fputc _errno fputc 56508->56515 56514 411040 fputc _errno fputc 56509->56514 56512 40f138 56512->56486 56513 40f170 56513->56486 56514->56512 56515->56513 56517 40e63d mbstowcs 56516->56517 56517->56496 56517->56497 56518 408100 56521 408b00 56518->56521 56522 408b60 MultiByteToWideChar 56521->56522 56523 408b13 56521->56523 56525 408bf8 56522->56525 56526 408b9c calloc 56522->56526 56524 408b1d MultiByteToWideChar 56523->56524 56528 408bd8 56524->56528 56533 408121 LoadLibraryExW free 56524->56533 56536 402f90 12 API calls 56525->56536 56526->56524 56529 408bb9 56526->56529 56535 402f90 12 API calls 56528->56535 56534 402f90 12 API calls 56529->56534 56532 408bcd 56532->56533 56534->56532 56535->56533 56536->56533 56537 401e60 56538 402020 56537->56538 56539 401e75 56537->56539 56585 4046b0 56538->56585 56543 402014 56539->56543 56566 408550 malloc 56539->56566 56542 401eaa 56542->56543 56577 40ef60 56542->56577 56546 401ed4 fread 56549 402061 56546->56549 56550 401efd 56546->56550 56547 40208f 56593 403030 14 API calls 56547->56593 56592 403030 14 API calls 56549->56592 56551 40ef60 6 API calls 56550->56551 56553 401f57 malloc 56551->56553 56554 4020a5 56553->56554 56555 401f6d fread 56553->56555 56594 403030 14 API calls 56554->56594 56556 402046 56555->56556 56557 401f8f ferror 56555->56557 56591 403030 14 API calls 56556->56591 56560 40207c 56557->56560 56563 401fac 56557->56563 56561 402ed0 12 API calls 56560->56561 56561->56543 56562 401ff6 56562->56543 56564 402006 fclose 56562->56564 56563->56562 56580 402ed0 56563->56580 56564->56543 56567 408571 56566->56567 56568 4086b2 free 56566->56568 56570 40ef60 6 API calls 56567->56570 56568->56542 56571 40858d 56570->56571 56571->56568 56595 40f050 56571->56595 56573 40ef60 6 API calls 56575 4085a1 56573->56575 56574 40863f fread 56574->56568 56574->56575 56575->56568 56575->56573 56575->56574 56576 408670 memcmp 56575->56576 56576->56568 56576->56575 56600 40ef90 56577->56600 56581 40f100 3 API calls 56580->56581 56582 402f01 56581->56582 56610 402df0 56582->56610 56584 402f19 56584->56563 56586 4046bc 56585->56586 56587 408b00 12 API calls 56586->56587 56588 4046e1 56587->56588 56589 408b00 12 API calls 56588->56589 56590 4046fc _wfopen 56589->56590 56590->56539 56591->56543 56592->56543 56593->56543 56594->56543 56598 40f070 fgetpos 56595->56598 56599 40f05f 56598->56599 56599->56575 56601 40efd8 fgetpos 56600->56601 56602 40efac 56600->56602 56603 40efec 56601->56603 56607 401ecc 56601->56607 56604 40f000 fflush _fileno _filelengthi64 56602->56604 56605 40efb1 56602->56605 56603->56604 56606 40efc1 fsetpos 56603->56606 56604->56606 56608 40efb5 56605->56608 56609 40f02a _errno 56605->56609 56606->56607 56607->56546 56607->56547 56608->56606 56609->56607 56611 402dfc 56610->56611 56612 408b00 10 API calls 56611->56612 56613 402e38 56612->56613 56614 402e90 MessageBoxA 56613->56614 56615 402e3c 56613->56615 56614->56584 56616 408b00 10 API calls 56615->56616 56617 402e5e MessageBoxW 56616->56617 56617->56584 56618 4038e1 56623 4038e8 56618->56623 56620 4039e0 56623->56620 56624 403955 PyUnicode_FromString PyObject_SetAttrString Py_DecRef PyMarshal_ReadObjectFromString 56623->56624 56625 4039ed 56623->56625 56651 401980 56623->56651 56656 4019c0 56623->56656 56686 403270 56623->56686 56626 403a09 56624->56626 56627 40399c PyObject_SetAttrString PyEval_EvalCode 56624->56627 56628 402ed0 12 API calls 56625->56628 56632 402ed0 12 API calls 56626->56632 56629 4039d2 free 56627->56629 56630 403a33 PyErr_Fetch PyErr_NormalizeException PyObject_Str PyUnicode_AsUTF8 56627->56630 56631 4039f9 56628->56631 56629->56623 56634 403a89 Py_DecRef 56630->56634 56635 403a7f _strdup 56630->56635 56633 403a1d PyErr_Print 56632->56633 56689 402270 14 API calls 56634->56689 56635->56634 56637 403aa2 56638 403aac _strdup PyErr_Restore PyErr_Print 56637->56638 56639 403b3d PyImport_ImportModule 56637->56639 56690 402ce0 33 API calls 56638->56690 56641 403b68 PyObject_GetAttrString 56639->56641 56642 403c8d Py_DecRef 56639->56642 56643 403c80 Py_DecRef 56641->56643 56644 403b85 PyObject_CallFunctionObjArgs 56641->56644 56647 403c9b 56642->56647 56643->56642 56646 403bb6 9 API calls 56644->56646 56644->56647 56645 403af1 free free 56646->56647 56648 403c51 PyUnicode_AsUTF8 56646->56648 56649 403c6a Py_DecRef Py_DecRef 56647->56649 56648->56649 56650 403c60 _strdup 56648->56650 56649->56643 56650->56649 56652 4019a0 56651->56652 56653 401993 56651->56653 56654 402ed0 12 API calls 56652->56654 56653->56623 56655 4019ac 56654->56655 56655->56623 56657 401b30 56656->56657 56658 4019d9 56656->56658 56659 4046b0 13 API calls 56657->56659 56660 40ef60 6 API calls 56658->56660 56661 401b43 56659->56661 56662 4019fb 56660->56662 56661->56658 56663 401b51 56661->56663 56664 401b70 56662->56664 56665 401a07 malloc 56662->56665 56666 402ed0 12 API calls 56663->56666 56718 403030 14 API calls 56664->56718 56668 401a1e 56665->56668 56669 401b9f 56665->56669 56682 401af0 56666->56682 56672 401b00 56668->56672 56673 401a2c 56668->56673 56719 403030 14 API calls 56669->56719 56670 401b8b 56670->56623 56692 401610 56672->56692 56675 401adc 56673->56675 56678 401a73 fread 56673->56678 56681 401a48 56673->56681 56676 401ae2 fclose 56675->56676 56675->56682 56676->56682 56677 401b14 56677->56675 56679 401ac8 free 56677->56679 56680 401aa5 56678->56680 56678->56681 56679->56675 56691 403030 14 API calls 56680->56691 56681->56673 56681->56678 56683 401b20 56681->56683 56682->56623 56683->56676 56685 401b2a 56683->56685 56685->56682 56687 40f100 3 API calls 56686->56687 56688 403297 56687->56688 56688->56623 56689->56637 56690->56645 56691->56679 56720 40a4f0 56692->56720 56695 401672 malloc 56697 401688 malloc 56695->56697 56698 401919 56695->56698 56696 4018d4 56699 402ed0 12 API calls 56696->56699 56700 4016a4 56697->56700 56701 4018f9 56697->56701 56724 403030 14 API calls 56698->56724 56702 401846 56699->56702 56706 4016d5 fread 56700->56706 56707 401858 56700->56707 56708 401826 56700->56708 56712 401770 fwrite 56700->56712 56713 40187f memcpy 56700->56713 56717 4017e9 56700->56717 56723 403030 14 API calls 56701->56723 56702->56677 56705 401938 56706->56708 56709 401701 ferror 56706->56709 56707->56677 56710 401832 free free 56708->56710 56709->56700 56709->56708 56710->56702 56711 402ed0 12 API calls 56711->56708 56714 4018ca 56712->56714 56715 40179c ferror 56712->56715 56713->56700 56714->56717 56715->56714 56716 4017b0 56715->56716 56716->56700 56717->56708 56717->56711 56718->56670 56719->56675 56725 40a3f0 56720->56725 56722 401668 56722->56695 56722->56696 56723->56708 56724->56705 56726 40a405 56725->56726 56728 40a45c 56725->56728 56727 40a43d malloc 56726->56727 56726->56728 56727->56728 56728->56722 56729 405dc4 56731 405dc8 56729->56731 56730 402ed0 12 API calls 56730->56731 56731->56730 56732 405da4 PyErr_Occurred 56731->56732 56733 405dba free 56732->56733 56734 405dae PyErr_Print PyErr_Clear 56732->56734 56735 405d50 56733->56735 56734->56733 56736 401980 12 API calls 56735->56736 56737 405de0 56735->56737 56738 4019c0 35 API calls 56735->56738 56736->56735 56739 405d7d PyMarshal_ReadObjectFromString 56738->56739 56739->56731 56740 405d93 PyImport_ExecCodeModule 56739->56740 56740->56731 56740->56732 56741 401124 __wgetmainargs 56742 408668 56743 408670 memcmp 56742->56743 56744 4086b2 free 56743->56744 56747 4085d6 56743->56747 56746 40ef60 6 API calls 56746->56747 56747->56743 56747->56744 56747->56746 56748 40863f fread 56747->56748 56748->56744 56748->56747 56749 46baf00 PyModule_Create2 56750 46baf1f PyModule_GetDict PyImport_ImportModule 56749->56750 56751 46bb0b1 56749->56751 56752 46baf6a PyModule_GetDict PyDict_GetItemString 56750->56752 56753 46baf40 56750->56753 56754 46baf9e 56752->56754 56755 46baf91 56752->56755 56753->56751 56757 46baf58 _Py_Dealloc 56753->56757 56756 46bb086 PyErr_SetString 56754->56756 56759 46bafb5 PyCapsule_GetPointer 56754->56759 56755->56754 56758 46baf98 _Py_Dealloc 56755->56758 56760 46bb09b 56756->56760 56758->56754 56759->56760 56762 46bafd1 56759->56762 56760->56751 56761 46bb0ab _Py_Dealloc 56760->56761 56761->56751 56762->56760 56763 46bb04c 56762->56763 56764 46bb041 Py_FatalError 56762->56764 56763->56760 56765 46bb06a 56763->56765 56764->56763 56768 47586e0 72 API calls 56765->56768 56767 46bb07b 56768->56767 56769 401b2c 56770 401b30 56769->56770 56771 4046b0 13 API calls 56770->56771 56772 401b43 56771->56772 56773 401b51 56772->56773 56774 4019d9 56772->56774 56775 402ed0 12 API calls 56773->56775 56776 40ef60 6 API calls 56774->56776 56795 401af0 56775->56795 56777 4019fb 56776->56777 56778 401b70 56777->56778 56779 401a07 malloc 56777->56779 56800 403030 14 API calls 56778->56800 56781 401a1e 56779->56781 56782 401b9f 56779->56782 56785 401b00 56781->56785 56786 401a2c 56781->56786 56801 403030 14 API calls 56782->56801 56783 401b8b 56788 401610 24 API calls 56785->56788 56787 401adc 56786->56787 56791 401a73 fread 56786->56791 56792 401a48 56786->56792 56789 401ae2 fclose 56787->56789 56787->56795 56790 401b14 56788->56790 56789->56795 56790->56787 56793 401ac8 free 56790->56793 56791->56792 56794 401aa5 56791->56794 56792->56786 56792->56791 56796 401b20 56792->56796 56793->56787 56799 403030 14 API calls 56794->56799 56796->56789 56798 401b2a 56796->56798 56798->56795 56799->56793 56800->56783 56801->56787 56802 4044f0 56803 4044fb 56802->56803 56804 408b00 12 API calls 56803->56804 56805 40451c _wstat 56804->56805 56806 40a4b1 56807 40a436 malloc 56806->56807 56809 40a45c 56807->56809 56810 4011b3 56811 4011b8 56810->56811 56812 4011c0 Sleep 56811->56812 56817 4011ea 56811->56817 56813 4011cc 56812->56813 56813->56811 56823 4011da 56813->56823 56814 401406 _amsg_exit 56816 401420 _initterm 56814->56816 56814->56817 56815 401478 _initterm 56818 40149b 56815->56818 56816->56817 56817->56814 56817->56815 56817->56816 56817->56823 56821 4014a3 exit 56818->56821 56820 401241 SetUnhandledExceptionFilter 56820->56823 56822 401267 __p__wcmdln 56822->56823 56823->56814 56823->56817 56823->56822 56824 4012eb malloc 56823->56824 56825 4012e6 56823->56825 56836 40db40 12 API calls 56823->56836 56824->56818 56826 401311 malloc memcpy 56824->56826 56825->56824 56828 40136f 56826->56828 56837 40d710 _onexit 56828->56837 56830 401388 56838 40d7a0 378 API calls 56830->56838 56832 4013af 56832->56821 56833 4013c2 56832->56833 56834 4013d0 56833->56834 56835 401462 _cexit 56833->56835 56836->56820 56837->56830 56838->56832 56839 4017f4 56847 4016b1 56839->56847 56840 4017e9 56843 402ed0 12 API calls 56840->56843 56852 401826 56840->56852 56841 401770 fwrite 56844 4018ca 56841->56844 56845 40179c ferror 56841->56845 56842 40187f memcpy 56842->56847 56843->56852 56844->56840 56845->56844 56846 4017b0 56845->56846 56846->56847 56847->56840 56847->56841 56847->56842 56849 4016d5 fread 56847->56849 56850 401858 56847->56850 56847->56852 56848 401832 free free 56851 401846 56848->56851 56849->56852 56853 401701 ferror 56849->56853 56852->56848 56853->56847 56853->56852 56854 4757fe0 56855 4757ffb 56854->56855 56856 4758006 56855->56856 56857 475800e PyDict_Next 56855->56857 56858 4758671 56857->56858 56859 4758036 56857->56859 56860 4758690 56858->56860 56862 475868a _Py_Dealloc 56858->56862 56861 475803e PyObject_GetAttr 56859->56861 56863 4758065 PyType_GetFlags 56861->56863 56864 47582e9 PyErr_Clear 56861->56864 56862->56860 56865 475807c PyList_Size 56863->56865 56881 4758090 56863->56881 56864->56881 56865->56881 56866 475864d PyDict_Next 56866->56858 56866->56861 56867 4758316 PyType_IsSubtype 56867->56881 56868 47580a0 PyList_GetItem 56897 474ce70 PyCapsule_GetPointer 56868->56897 56869 47582de _Py_Dealloc 56869->56866 56871 475833b PyType_IsSubtype 56872 4758346 PyErr_Clear 56871->56872 56871->56881 56872->56881 56873 47584e2 ?createData@QMapDataBase@@SAPAU1 56873->56881 56875 475859d ?createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N 56875->56881 56876 47580e9 ?constData@QByteArray@ ?constData@QByteArray@ 56876->56881 56878 4758173 56884 47582a1 PyList_Size 56878->56884 56885 4758297 ?append@QListData@ 56878->56885 56886 47581af ?detach_grow@QListData@@QAEPAUData@1@PAHH 56878->56886 56889 47581fc memcpy 56878->56889 56890 4758264 ?dispose@QListData@@SAXPAUData@1@ 56878->56890 56891 4758239 memcpy 56878->56891 56898 4759483 _callnewh malloc _CxxThrowException _CxxThrowException 56878->56898 56880 4758546 ?recalcMostLeftNode@QMapDataBase@ 56880->56881 56881->56858 56881->56866 56881->56867 56881->56868 56881->56869 56881->56871 56881->56873 56881->56875 56881->56876 56881->56878 56881->56880 56882 4758531 ?freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H 56881->56882 56883 475853c ?freeData@QMapDataBase@@SAXPAU1@ 56881->56883 56881->56884 56887 4758464 ?append@QListData@ 56881->56887 56888 4758397 ?detach_grow@QListData@@QAEPAUData@1@PAHH 56881->56888 56892 47583df memcpy 56881->56892 56893 475841c memcpy 56881->56893 56894 4758447 ?dispose@QListData@@SAXPAUData@1@ 56881->56894 56895 475849b _Py_Dealloc 56881->56895 56896 4758636 ?addRelatedMetaObject@QMetaObjectBuilder@@QAEHPBUQMetaObject@@ 56881->56896 56899 4753170 6 API calls 56881->56899 56900 4757410 ?createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N 56881->56900 56882->56883 56883->56880 56884->56868 56884->56881 56885->56884 56886->56878 56887->56881 56888->56881 56889->56878 56890->56878 56891->56878 56892->56881 56893->56881 56894->56881 56895->56866 56896->56881 56897->56881 56898->56878 56899->56881 56900->56881 56901 4018b6 56902 401826 56901->56902 56903 401832 free free 56902->56903 56904 401846 56903->56904

                                          Executed Functions

                                          Function 0040117C Relevance: 18.2, APIs: 12, Instructions: 206sleepCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 565 40117c-40119a 566 4011a0-4011b1 565->566 567 401451-40145a GetStartupInfoW 565->567 568 4011cc-4011d8 566->568 569 401462-401477 _cexit 567->569 570 4011b8-4011ba 568->570 571 4011da-4011e4 568->571 572 4011c0-4011c9 Sleep 570->572 573 4013f3-401400 570->573 574 401406-40141a _amsg_exit 571->574 575 4011ea-4011f1 571->575 572->568 573->574 573->575 578 401420-401440 _initterm 574->578 579 40120f-401211 574->579 576 4011f7-401209 575->576 577 401478-401491 _initterm 575->577 576->578 576->579 582 40149b 577->582 580 401446-40144c 578->580 581 401217-40121e 578->581 579->580 579->581 580->581 583 401220-401239 581->583 584 40123c-40127c call 40db40 SetUnhandledExceptionFilter call 4173c0 call 40d970 __p__wcmdln 581->584 588 4014a3-4014af exit 582->588 583->584 593 401292-401299 584->593 594 40127e 584->594 595 401280-401283 593->595 596 40129b-4012a7 593->596 597 4012cd-4012d5 594->597 598 401285-401288 595->598 599 4012a9-4012b0 595->599 600 40128f 596->600 601 4012d7-4012e0 597->601 602 4012eb-40130b malloc 597->602 598->599 603 40128a 598->603 604 4012b2 599->604 605 4012c8 599->605 600->593 606 4012e6 601->606 607 4013ea 601->607 602->582 608 401311-40131d 602->608 603->600 609 4012b8-4012c6 604->609 605->597 606->602 607->573 610 401320-401326 608->610 609->605 609->609 611 4013e0-4013e5 610->611 612 40132c-401331 610->612 614 401346-40136d malloc memcpy 611->614 613 401338-401341 612->613 613->613 615 401343 613->615 614->610 616 40136f-4013bc call 40d770 call 40d7a0 614->616 615->614 616->588 621 4013c2-4013ca 616->621 621->569 622 4013d0-4013db 621->622
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction ID: 676354774380156a6d31bcdc11651c5caae96c91ab7a06ee3bbcf8190cbc5d75
                                          • Opcode Fuzzy Hash: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                          • Instruction Fuzzy Hash: BF81AF70A042018FDB24EFA4D98576A77F0FB44304F51453EDA85AB3B1D7789885CB8A
                                          Function 00403880 Relevance: 91.3, APIs: 39, Strings: 13, Instructions: 262COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • PyImport_AddModule.PYTHON310 ref: 004038A1
                                          • PyModule_GetDict.PYTHON310 ref: 004038B4
                                          • PyUnicode_FromString.PYTHON310 ref: 0040395C
                                          • PyObject_SetAttrString.PYTHON310 ref: 00403975
                                          • Py_DecRef.PYTHON310 ref: 00403982
                                          • PyMarshal_ReadObjectFromString.PYTHON310 ref: 00403992
                                          • PyObject_SetAttrString.PYTHON310 ref: 004039AF
                                          • PyEval_EvalCode.PYTHON310 ref: 004039C8
                                          • free.MSVCRT ref: 004039D5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String$AttrFromObject_$CodeDictEvalEval_Import_Marshal_ModuleModule_ObjectReadUnicode_free
                                          • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                          • API String ID: 1659846952-4198433784
                                          • Opcode ID: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction ID: 6540644356b1fe9e7dd3889ac2da6173512776e99aae4954ed64b62622b12aad
                                          • Opcode Fuzzy Hash: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                          • Instruction Fuzzy Hash: 35B1C4B4608701DFC710AF29D58815ABBE4BF88355F41892EE9D9D3390DBB8C981CF5A
                                          Function 04757FE0 Relevance: 48.6, APIs: 32, Instructions: 571COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 49 4757fe0-4758004 51 4758006-475800d 49->51 52 475800e-4758030 PyDict_Next 49->52 53 4758675-4758681 52->53 54 4758036-475803d 52->54 55 4758690-4758697 53->55 56 4758683-4758688 53->56 57 475803e-475805f PyObject_GetAttr 54->57 56->55 58 475868a-475868d _Py_Dealloc 56->58 59 4758065-4758076 PyType_GetFlags 57->59 60 47582e9-4758310 PyErr_Clear 57->60 58->55 61 47582c6-47582cd 59->61 62 475807c-475808a PyList_Size 59->62 68 4758316-4758325 PyType_IsSubtype 60->68 69 47584b0-47584b2 60->69 65 47582d3-47582d8 61->65 66 475864d-475866b PyDict_Next 61->66 63 47582c0 62->63 64 4758090-475809b 62->64 63->61 70 47580a0-47580c3 PyList_GetItem call 474ce70 64->70 65->66 71 47582de-47582e4 _Py_Dealloc 65->71 66->57 72 4758671 66->72 74 47584ac 68->74 75 475832b-4758339 68->75 77 47586a6-47586af 69->77 78 47584b8-47584bf 69->78 88 47580c9-47580cc 70->88 89 475817b-47581a1 call 4759483 call 4753d30 70->89 71->66 73 4758673-4758674 72->73 73->53 74->69 81 4758357-4758359 75->81 82 475833b-4758344 PyType_IsSubtype 75->82 77->73 79 47584c1-47584c4 78->79 80 47584c8-47584dc 78->80 79->80 84 4758551-4758563 80->84 85 47584de-47584e0 80->85 81->77 90 475835f-475837f call 4753170 81->90 86 4758346-475834e PyErr_Clear 82->86 87 4758353 82->87 95 4758565 84->95 96 475859d-47585bd ?createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N@Z 84->96 85->84 91 47584e2-47584f2 ?createData@QMapDataBase@@SAPAU1@XZ 85->91 92 4758647 86->92 87->81 93 47580d0-47580e7 88->93 130 4758297-475829f ?append@QListData@@QAEPAPAXXZ 89->130 131 47581a7-47581a9 89->131 134 4758382-4758389 90->134 98 47584f4-475850b call 4757410 91->98 99 475850e-4758512 91->99 92->66 100 475815e-475816d 93->100 101 47580e9-4758101 ?constData@QByteArray@@QBEPBDXZ * 2 93->101 97 4758568-475856d 95->97 104 47585c0-47585cc call 474a720 96->104 105 4758576 97->105 106 475856f-4758574 97->106 98->99 112 4758514-4758517 99->112 113 4758527-475852f 99->113 100->93 107 4758173-4758177 100->107 109 4758114-4758117 101->109 110 4758103-4758107 101->110 135 4758641 104->135 136 47585ce-47585d2 104->136 116 4758579-475857e 105->116 106->116 107->89 118 475811d-4758121 109->118 123 4758289-4758295 109->123 110->118 119 4758109-4758112 110->119 121 4758546-475854b ?recalcMostLeftNode@QMapDataBase@@QAEXXZ 112->121 122 4758519-4758525 112->122 126 4758531-4758536 ?freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H@Z 113->126 127 475853c-4758543 ?freeData@QMapDataBase@@SAXPAU1@@Z 113->127 116->97 128 4758580-4758586 116->128 132 4758123-4758126 118->132 133 475815a 118->133 119->109 119->110 121->84 122->113 122->121 129 47582a1-47582b4 PyList_Size 123->129 126->127 127->121 128->96 137 4758588-475858f 128->137 129->70 138 47582ba 129->138 130->129 131->130 139 47581af-47581f1 ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z 131->139 132->123 140 475812c-4758132 132->140 133->100 141 4758464-475846c ?append@QListData@@QAEPAPAXXZ 134->141 142 475838f-4758391 134->142 135->92 136->135 143 47585d4-47585e9 136->143 137->96 144 4758591-475859b 137->144 138->63 146 4758215-475822e 139->146 147 47581f3-47581fa 139->147 140->133 148 4758134-4758137 140->148 145 475846e-4758473 141->145 142->141 149 4758397-47583d4 ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z 142->149 143->135 166 47585eb-47585f6 call 474eef0 143->166 144->104 145->134 150 4758479-4758484 145->150 152 4758230-4758237 146->152 153 475824b-475824f 146->153 147->146 151 47581fc-4758212 memcpy 147->151 148->123 154 475813d-4758143 148->154 155 47583f7-4758411 149->155 156 47583d6-47583dd 149->156 150->135 162 475848a-4758495 150->162 151->146 152->153 163 4758239-4758248 memcpy 152->163 158 4758264-475826b ?dispose@QListData@@SAXPAUData@1@@Z 153->158 159 4758251-4758254 153->159 154->133 164 4758145-4758148 154->164 160 4758413-475841a 155->160 161 475842e-4758432 155->161 156->155 165 47583df-47583f5 memcpy 156->165 170 475826e-4758287 158->170 169 4758256-4758262 159->169 159->170 160->161 171 475841c-475842b memcpy 160->171 172 4758434-4758437 161->172 173 4758447-475844e ?dispose@QListData@@SAXPAUData@1@@Z 161->173 174 475869e-47586a4 162->174 175 475849b-47584a7 _Py_Dealloc 162->175 163->153 164->123 167 475814e-4758154 164->167 165->155 179 47585fc-4758601 166->179 180 4758698 166->180 167->123 167->133 169->158 169->170 170->129 171->161 177 4758451-4758462 172->177 178 4758439-4758445 172->178 173->177 174->66 175->66 177->145 178->173 178->177 179->135 181 4758603-4758616 179->181 180->174 183 4758630-4758634 181->183 184 4758618-475862b 181->184 183->135 185 4758636-475863b ?addRelatedMetaObject@QMetaObjectBuilder@@QAEHPBUQMetaObject@@@Z 183->185 184->135 187 475862d 184->187 185->135 187->183
                                          APIs
                                          • PyDict_Next.PYTHON3(00000000,?,?,?,00000000,?,04757EF4,00000000,?,00000000,047575B7,04757EF4,00000000,?,?,?), ref: 0475801F
                                          • PyObject_GetAttr.PYTHON3(?,00000000,04757EF4,?,?,?,?,?,?,?,?,00000000,047575B7,04757EF4,00000000,?), ref: 0475804E
                                          • PyType_GetFlags.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,00000000,047575B7,04757EF4,00000000,?), ref: 04758068
                                          • PyList_Size.PYTHON3(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,047575B7,04757EF4,00000000), ref: 04758083
                                          • PyList_GetItem.PYTHON3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,047575B7), ref: 047580A2
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 047580EB
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 047580F6
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?constArray@@ByteData@List_$AttrDict_FlagsItemNextObject_SizeType_
                                          • String ID:
                                          • API String ID: 3660667503-0
                                          • Opcode ID: c8db2c7b27880822c7ee039e9d1c35fd69ea8fdfaec94deaa946413769e8e57c
                                          • Instruction ID: a5fc12f274f3e138d3ce221eb3390f3cacca13e919a766fa914a382e7cff4944
                                          • Opcode Fuzzy Hash: c8db2c7b27880822c7ee039e9d1c35fd69ea8fdfaec94deaa946413769e8e57c
                                          • Instruction Fuzzy Hash: 60228D716003018FD714EF28D88496AB7E5FF84324B198A68EC559F3A1E7B1FD25CB92
                                          Function 04753F10 Relevance: 40.8, APIs: 27, Instructions: 319COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 188 4753f10-4753f30 189 4753f35-4753f4f _Py_Dealloc 188->189 190 4753f32-4753f33 188->190 191 4753f55-4753f86 PyErr_Fetch PyErr_GivenExceptionMatches 189->191 192 47540d1-47540d8 189->192 190->189 195 4753f8c-4753f91 191->195 196 475415a-475415f 191->196 193 47540e7-47540f0 192->193 194 47540da-47540df 192->194 194->193 200 47540e1-47540e4 _Py_Dealloc 194->200 197 4753f97-4753f9f PyTuple_Size 195->197 198 4754161-4754165 195->198 196->198 199 47541cf-47541d3 196->199 197->196 201 4753fa5-4753fa9 197->201 204 4754167-475416d 198->204 205 47541c1-47541cd 198->205 202 47541d5-47541df 199->202 203 47541e1-47541e7 199->203 200->193 206 4753fc1-4753fc7 201->206 207 4753fab-4753fbf 201->207 208 4754246-475424c PyErr_Restore 202->208 209 47541ff-4754205 203->209 210 47541e9-47541f0 203->210 211 4754187-475418d 204->211 212 475416f-4754177 204->212 205->208 215 4753fdf-4753fe5 206->215 216 4753fc9-4753fd0 206->216 214 475401b-4754030 PyTuple_Size PyTuple_GetSlice 207->214 213 475424f-4754256 208->213 219 4754207-475420e 209->219 220 475421d-4754223 209->220 210->209 217 47541f2-47541f7 210->217 221 47541a7-47541a9 211->221 222 475418f-4754197 211->222 212->211 218 4754179-475417f 212->218 225 4754265-475426e 213->225 226 4754258-475425d 213->226 223 4754036-475403e 214->223 224 47540f3-47540f9 214->224 229 4753fe7-4753fee 215->229 230 4753ffd-4754003 215->230 216->215 227 4753fd2-4753fd7 216->227 217->209 228 47541f9-47541fc _Py_Dealloc 217->228 218->211 231 4754181-4754184 _Py_Dealloc 218->231 219->220 232 4754210-4754215 219->232 234 4754225-475422c 220->234 235 475423b-4754245 220->235 221->205 236 47541ab-47541b2 221->236 222->221 233 4754199-475419f 222->233 237 4754040-4754045 223->237 238 475404d-4754065 PyObject_Call 223->238 243 4754111-4754117 224->243 244 47540fb-4754102 224->244 226->225 239 475425f-4754262 _Py_Dealloc 226->239 227->215 242 4753fd9-4753fdc _Py_Dealloc 227->242 228->209 229->230 245 4753ff0-4753ff5 229->245 230->214 247 4754005-475400c 230->247 231->211 232->220 246 4754217-475421a _Py_Dealloc 232->246 233->221 240 47541a1-47541a4 _Py_Dealloc 233->240 234->235 248 475422e-4754233 234->248 235->208 236->205 241 47541b4-47541b9 236->241 237->238 250 4754047-475404a _Py_Dealloc 237->250 238->191 251 475406b-475406f 238->251 239->225 240->221 241->205 249 47541bb-47541be _Py_Dealloc 241->249 242->215 254 475412f-4754131 243->254 255 4754119-4754120 243->255 244->243 252 4754104-4754109 244->252 245->230 253 4753ff7-4753ffa _Py_Dealloc 245->253 246->220 247->214 256 475400e-4754013 247->256 248->235 257 4754235-4754238 _Py_Dealloc 248->257 249->205 250->238 259 4754071-4754077 251->259 260 47540cd 251->260 252->243 261 475410b-475410e _Py_Dealloc 252->261 253->230 254->213 258 4754137-475413e 254->258 255->254 262 4754122-4754127 255->262 256->214 263 4754015-4754018 _Py_Dealloc 256->263 257->235 258->213 264 4754144-4754149 258->264 265 475408f-4754095 259->265 266 4754079-4754080 259->266 260->192 261->243 262->254 267 4754129-475412c _Py_Dealloc 262->267 263->214 264->213 268 475414f-4754155 _Py_Dealloc 264->268 270 4754097-475409e 265->270 271 47540ad-47540af 265->271 266->265 269 4754082-4754087 266->269 267->254 268->213 269->265 272 4754089-475408c _Py_Dealloc 269->272 270->271 273 47540a0-47540a5 270->273 274 47540c7 PyErr_Clear 271->274 275 47540b1-47540b8 271->275 272->265 273->271 276 47540a7-47540aa _Py_Dealloc 273->276 274->260 275->274 277 47540ba-47540bf 275->277 276->271 277->274 278 47540c1-47540c4 _Py_Dealloc 277->278 278->274
                                          APIs
                                          • _Py_Dealloc.PYTHON3(?,?,00000000,00000000,?,?,00000000), ref: 04753F3C
                                          • PyErr_Fetch.PYTHON3(?,?,?), ref: 04753F6A
                                          • PyErr_GivenExceptionMatches.PYTHON3(?,6C969584), ref: 04753F7B
                                          • PyTuple_Size.PYTHON3(?), ref: 04753F98
                                          • _Py_Dealloc.PYTHON3(?), ref: 04753FDA
                                          • _Py_Dealloc.PYTHON3(?), ref: 04753FF8
                                          • _Py_Dealloc.PYTHON3(?), ref: 04754016
                                          • PyTuple_Size.PYTHON3(?), ref: 0475401C
                                          • PyTuple_GetSlice.PYTHON3(?,00000000,-00000001), ref: 04754023
                                          • _Py_Dealloc.PYTHON3(?), ref: 04754048
                                          • PyObject_Call.PYTHON3(?,00000000,00000000), ref: 04754056
                                          • _Py_Dealloc.PYTHON3(?), ref: 0475408A
                                          • _Py_Dealloc.PYTHON3(?), ref: 047540A8
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 047540C2
                                          • PyErr_Clear.PYTHON3 ref: 047540C7
                                          • _Py_Dealloc.PYTHON3(?), ref: 047540E2
                                          • _Py_Dealloc.PYTHON3(?), ref: 0475410C
                                          • _Py_Dealloc.PYTHON3(?), ref: 0475412A
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04754150
                                          • _Py_Dealloc.PYTHON3(?), ref: 04754182
                                          • _Py_Dealloc.PYTHON3(?), ref: 047541A2
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 047541BC
                                          • _Py_Dealloc.PYTHON3(?), ref: 047541FA
                                          • _Py_Dealloc.PYTHON3(?), ref: 04754218
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04754236
                                          • PyErr_Restore.PYTHON3(?,?,00000000), ref: 04754246
                                          • _Py_Dealloc.PYTHON3(?), ref: 04754260
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Dealloc$Err_$Tuple_$Size$CallClearExceptionFetchGivenMatchesObject_RestoreSlice
                                          • String ID:
                                          • API String ID: 3097676124-0
                                          • Opcode ID: c7157b4e19b775b205889a12a6007614c63b3644ee9cc37c9f67309a270eed55
                                          • Instruction ID: 8ae960929d1945f51beee083657e31564b00ae05806b29b118199971fe6354b1
                                          • Opcode Fuzzy Hash: c7157b4e19b775b205889a12a6007614c63b3644ee9cc37c9f67309a270eed55
                                          • Instruction Fuzzy Hash: 2BB193716043459BD724AF389C40B6A73A5AF51328F240B6CFC658E3F0E7B2E9568B52
                                          Function 046BAF00 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 141COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 279 46baf00-46baf19 PyModule_Create2 280 46baf1f-46baf3e PyModule_GetDict PyImport_ImportModule 279->280 281 46bb0b1-46bb0b8 279->281 282 46baf6a-46baf8f PyModule_GetDict PyDict_GetItemString 280->282 283 46baf40-46baf47 280->283 285 46baf9e-46bafa0 282->285 286 46baf91-46baf96 282->286 283->281 284 46baf4d-46baf52 283->284 284->281 289 46baf58-46baf69 _Py_Dealloc 284->289 287 46bb086-46bb098 PyErr_SetString 285->287 288 46bafa6-46bafaf 285->288 286->285 290 46baf98-46baf9b _Py_Dealloc 286->290 292 46bb09b-46bb0a2 287->292 288->287 291 46bafb5-46bafcb PyCapsule_GetPointer 288->291 290->285 291->292 293 46bafd1-46bafef call 474ecd0 291->293 292->281 294 46bb0a4-46bb0a9 292->294 293->292 299 46baff5-46bb03f 293->299 294->281 296 46bb0ab-46bb0ae _Py_Dealloc 294->296 296->281 303 46bb04c-46bb068 299->303 304 46bb041-46bb046 Py_FatalError 299->304 303->292 306 46bb06a-46bb085 call 47586e0 303->306 304->303
                                          APIs
                                          • PyModule_Create2.PYTHON3(047E5A58,00000003), ref: 046BAF0C
                                          • PyModule_GetDict.PYTHON3(00000000), ref: 046BAF26
                                          • PyImport_ImportModule.PYTHON3(PyQt5.sip), ref: 046BAF31
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 046BAF59
                                          • PyModule_GetDict.PYTHON3(00000000,_C_API), ref: 046BAF70
                                          • PyDict_GetItemString.PYTHON3(00000000), ref: 046BAF76
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 046BAF99
                                          • PyCapsule_GetPointer.PYTHON3(00000000,PyQt5.sip._C_API), ref: 046BAFBB
                                          • Py_FatalError.PYTHON3(Unable to import qtcore_qt_metacast), ref: 046BB046
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Module_$DeallocDict$Capsule_Create2Dict_ErrorFatalImportImport_ItemModulePointerString
                                          • String ID: PyQt5.sip$PyQt5.sip._C_API$PyQt5.sip._C_API is missing or has the wrong type$Unable to import qtcore_qt_metacast$_C_API$qtcore_qt_metacall$qtcore_qt_metacast$qtcore_qt_metaobject
                                          • API String ID: 2234918791-1457681641
                                          • Opcode ID: 2edd9ab22363275df6a2b1b6621fe79dc865a9227a54a179c6ff7a42b17a6c7a
                                          • Instruction ID: d404a19c7a20565deada705519b7b45c819ebe6d7385e58f6ec5f960083a249f
                                          • Opcode Fuzzy Hash: 2edd9ab22363275df6a2b1b6621fe79dc865a9227a54a179c6ff7a42b17a6c7a
                                          • Instruction Fuzzy Hash: E441B0B16403005BD320EF68EC85EEA37E9EB54775B144934F965CB380F6A5BA418BD2
                                          Function 00401610 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 186fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 309 401610-40166c call 40a4f0 312 401672-401682 malloc 309->312 313 4018d4-4018f4 call 402ed0 309->313 314 401688-40169e malloc 312->314 315 401919-401938 call 403030 312->315 322 401846-401852 313->322 317 4016a4-4016ad 314->317 318 4018f9-401914 call 403030 314->318 321 4016b1-4016cf 317->321 330 401826-401841 call 40c7c0 free * 2 318->330 325 4016d5-4016fb fread 321->325 326 401858-401868 321->326 328 4018c0-4018c5 325->328 329 401701-40170f ferror 325->329 328->330 329->328 331 401715-40171d 329->331 330->322 333 401721-40174a call 40a5c0 331->333 337 401750-401753 333->337 338 4017f8-4017fb 333->338 340 401759-40176a 337->340 341 401806-401821 call 402ed0 337->341 339 401801 338->339 338->340 339->341 343 401870-401879 340->343 344 401770-401796 fwrite 340->344 341->330 345 4017b4-4017b6 343->345 346 40187f-4018b1 memcpy 343->346 347 4018ca-4018cf 344->347 348 40179c-4017aa ferror 344->348 345->333 350 4017bc-4017dd 345->350 346->345 347->341 348->347 349 4017b0 348->349 349->345 350->330 351 4017df-4017e3 350->351 351->321 352 4017e9-4017f0 351->352 352->330 353 4017f2 352->353 353->341
                                          APIs
                                          Strings
                                          • Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 004018E1
                                          • 1.2.13, xrefs: 00401628
                                          • Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 004018FC
                                          • 8, xrefs: 00401620
                                          • Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 0040191D
                                          • malloc, xrefs: 00401908, 00401925
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ferrorfreemalloc$freadfwritememcpy
                                          • String ID: 1.2.13$8$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                          • API String ID: 3882407908-2046485118
                                          • Opcode ID: d25199e72a9c78f064208eb155d88d6c3da84988dbe3a474574327916eacab17
                                          • Instruction ID: 36ffe3033784580453c6a567143783feaca3ec72a60cee7d1f4dfc22211088d5
                                          • Opcode Fuzzy Hash: d25199e72a9c78f064208eb155d88d6c3da84988dbe3a474574327916eacab17
                                          • Instruction Fuzzy Hash: F481D3B56093019FD750EF29C08461BBBE1BF88358F508A2EF4D8973A1E778D985CB46
                                          Function 00401E60 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 165COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 354 401e60-401e6f 355 402020-402039 call 4046b0 354->355 356 401e75-401eb0 call 408550 354->356 355->356 361 40203f-402044 355->361 356->361 362 401eb6-401ece call 40ef60 356->362 363 402014-40201d 361->363 366 401ed4-401ef7 fread 362->366 367 40208f-4020a3 call 403030 362->367 369 402061-40207a call 403030 366->369 370 401efd-401f67 call 40ef60 malloc 366->370 367->361 369->363 376 4020a5-4020bc call 403030 370->376 377 401f6d-401f89 fread 370->377 376->363 378 402046-40205f call 403030 377->378 379 401f8f-401fa6 ferror 377->379 378->363 383 40207c-40208d call 402ed0 379->383 384 401fac-401fb2 379->384 383->363 386 401fb8-401fba 384->386 388 402000-402004 386->388 389 401fbc-401fdf 386->389 388->363 392 402006-40200e fclose 388->392 389->386 391 401fe1-401ff4 call 402ed0 389->391 391->389 395 401ff6-401ffd 391->395 392->363 395->388
                                          APIs
                                            • Part of subcall function 00408550: malloc.MSVCRT ref: 00408562
                                            • Part of subcall function 00408550: fread.MSVCRT ref: 00408656
                                            • Part of subcall function 00408550: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401EAA), ref: 004086BF
                                          • fread.MSVCRT ref: 00401EF0
                                          • malloc.MSVCRT ref: 00401F5D
                                          • fread.MSVCRT ref: 00401F82
                                          • ferror.MSVCRT ref: 00401F9D
                                          • fclose.MSVCRT ref: 00402009
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fread$malloc$fcloseferrorfree
                                          • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$X$fread$fseek$malloc
                                          • API String ID: 938791849-202209224
                                          • Opcode ID: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction ID: 48232b83441798ba76066763261cf49e77d2abc7de2ba2fc6216de52d01d1662
                                          • Opcode Fuzzy Hash: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                          • Instruction Fuzzy Hash: 40616EB0905301CFCB04DF25C58865ABBE1BF88314F15C96EE9989B3D6D778D884CB9A
                                          Function 0040E900 Relevance: 27.3, APIs: 18, Instructions: 269COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 396 40e900-40e921 setlocale 397 40e923-40e92b _strdup 396->397 398 40e92d-40e946 setlocale 396->398 397->398 399 40e950-40e9b1 wcstombs realloc wcstombs setlocale free 398->399 400 40e948-40e94e 398->400 402 40e9b7-40e9c0 399->402 400->399 401 40e9c8-40ea1f mbstowcs call 40e630 mbstowcs 400->401 405 40ea60-40ea64 401->405 406 40ea21-40ea32 401->406 407 40ea67-40ea6c 405->407 408 40ec40-40ec44 406->408 409 40ea38-40ea3c 406->409 411 40ea80-40ea89 407->411 412 40ea6e-40ea71 407->412 408->407 413 40ec4a-40ec4f 408->413 409->408 410 40ea42-40ea46 409->410 410->407 415 40ea48-40ea56 410->415 416 40eaa4-40eaa8 411->416 412->399 413->407 414 40ec55-40ec70 setlocale free 413->414 417 40eb66-40eb69 414->417 415->407 418 40ea90-40ea96 416->418 419 40eaaa-40eab1 416->419 417->402 420 40ea98-40eaa2 418->420 421 40eabb-40eac2 418->421 422 40eab3-40eab7 419->422 423 40eac4-40eac8 419->423 420->416 424 40ead8-40eadb 420->424 421->423 425 40eab8 421->425 422->425 423->425 426 40eaca-40eacf 423->426 427 40eb70-40eb78 424->427 428 40eae1-40eae9 424->428 425->421 426->424 429 40ead1-40ead3 426->429 432 40eccb 427->432 433 40eb7e-40eb85 427->433 430 40eaeb-40eaef 428->430 431 40eafc-40eb49 wcstombs realloc wcstombs 428->431 429->420 430->431 434 40eaf1-40eaf9 430->434 435 40eb4e-40eb61 setlocale free 431->435 436 40ecd1-40ecd9 432->436 437 40eb8d-40eb9c 432->437 433->427 438 40eb87-40eb8b 433->438 434->431 435->417 439 40ece5-40eced 436->439 440 40ecdb-40ecdf 436->440 441 40ebb0-40ebbb 437->441 442 40eb9e-40eba2 437->442 438->427 438->437 439->437 443 40ecf3-40ecfb 439->443 440->437 440->439 441->441 446 40ebbd-40ebc1 441->446 444 40ec75-40ec79 442->444 445 40eba8-40ebaf 442->445 443->437 449 40ed01-40ed08 443->449 447 40ebd0 444->447 448 40ec7f-40ec82 444->448 445->441 446->441 450 40ebc3-40ebca 446->450 451 40ebd2-40ebd5 447->451 448->451 449->437 450->444 450->447 452 40ec9b-40ecbc wcstombs 451->452 453 40ebdb-40ebe0 451->453 452->435 455 40ecc2-40ecc6 452->455 454 40ec06-40ec11 453->454 456 40ec13 454->456 457 40ebe8-40ebf3 454->457 455->435 460 40ec16-40ec1a 456->460 458 40ec90-40ec92 457->458 459 40ebf9-40ebfb 457->459 458->460 461 40ebfd-40ec00 459->461 462 40ec28-40ec33 460->462 463 40ec1c-40ec22 460->463 461->454 464 40ec98 461->464 462->462 466 40ec35-40ec39 462->466 463->461 465 40ec24 463->465 464->452 465->462 466->462 467 40ec3b 466->467 467->461
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction ID: 614429c9ea5f0c0fbdd7ec2be82af17343d93239b7468d5b99009060838935dd
                                          • Opcode Fuzzy Hash: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                          • Instruction Fuzzy Hash: 48A161709042158ADB24AF66C0452BBF7F1FF44344F45883FE489A7391E33D9892DB8A
                                          Function 00405CF0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 72stringCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 468 405cf0-405d28 strlen PyUnicode_Decode 469 405dea-405dfb call 402ed0 468->469 470 405d2e-405d45 PySys_SetObject 468->470 478 405de2-405de9 469->478 471 405d63-405d6c 470->471 472 405d47 470->472 476 405d50-405d61 call 401980 471->476 477 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 471->477 474 405de0 472->474 474->478 476->471 476->474 483 405d93-405da2 PyImport_ExecCodeModule 477->483 484 405dc8-405dd8 call 402ed0 477->484 483->484 485 405da4-405dac PyErr_Occurred 483->485 484->485 487 405dba-405dc2 free 485->487 488 405dae-405db4 PyErr_Print PyErr_Clear 485->488 487->476 488->487
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$Object$ClearCodeDecodeExecFromImport_Marshal_ModuleOccurredPrintReadStringSys_Unicode_freestrlen
                                          • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
                                          • API String ID: 1645963791-985300917
                                          • Opcode ID: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction ID: b798077ea826a97b31ed519bc33854408a60d385b89e575b30205180b7c9f22a
                                          • Opcode Fuzzy Hash: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                          • Instruction Fuzzy Hash: 692117B0219B009BC7207F25D98856BBBE4FE80750F45892FE4C997291D7789482DF6B
                                          Function 004019C0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 141COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 490 4019c0-4019d3 491 401b30-401b4b call 4046b0 490->491 492 4019d9-401a01 call 40ef60 490->492 491->492 497 401b51-401b68 call 402ed0 491->497 498 401b70-401b9e call 403030 492->498 499 401a07-401a18 malloc 492->499 511 401af0-401afb 497->511 502 401a1e-401a26 499->502 503 401b9f-401bc2 call 403030 499->503 507 401b00-401b16 call 401610 502->507 508 401a2c-401a32 502->508 510 401adc-401ae0 503->510 519 401ac8-401ad4 free 507->519 520 401b18-401b1c 507->520 509 401a38-401a40 508->509 508->510 514 401a58-401a6a 509->514 510->511 515 401ae2-401aea fclose 510->515 517 401a73-401aa3 fread 514->517 518 401a6c-401a71 514->518 515->511 521 401aa5-401ac3 call 403030 517->521 522 401a48-401a52 517->522 518->517 519->510 520->515 523 401b1e 520->523 521->519 522->514 524 401b20-401b28 522->524 523->511 524->515 526 401b2a 524->526 526->511
                                          APIs
                                          • malloc.MSVCRT ref: 00401A0D
                                          • fread.MSVCRT ref: 00401A94
                                          • free.MSVCRT(?,?,?,?,0040638C,?,?,?,?,?,?,?,?,00000000,?,004040A4), ref: 00401ACF
                                          • fclose.MSVCRT ref: 00401AE5
                                          Strings
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401B73
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401B55
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401AAD
                                          • malloc, xrefs: 00401BB2
                                          • fread, xrefs: 00401AB5
                                          • Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00401BA7
                                          • fseek, xrefs: 00401B7F
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosefreadfreemalloc
                                          • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                          • API String ID: 3295367466-3659356012
                                          • Opcode ID: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction ID: c4bf1cbcbd5ed2c421977dfe96b942ab9f05e938e4513c73373e5f6d25da3068
                                          • Opcode Fuzzy Hash: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                          • Instruction Fuzzy Hash: A25103B16093019FD700EF2AD49461BBBE4AF85744F05882EF988DB351E779D885CF8A
                                          Function 004038E1 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • PyUnicode_FromString.PYTHON310 ref: 0040395C
                                          • PyObject_SetAttrString.PYTHON310 ref: 00403975
                                          • Py_DecRef.PYTHON310 ref: 00403982
                                          • PyMarshal_ReadObjectFromString.PYTHON310 ref: 00403992
                                          • PyObject_SetAttrString.PYTHON310 ref: 004039AF
                                          • PyEval_EvalCode.PYTHON310 ref: 004039C8
                                          • free.MSVCRT ref: 004039D5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String$AttrFromObject_$CodeEvalEval_Marshal_ObjectReadUnicode_free
                                          • String ID: %s%c%s.py$\$__file__$_pyi_main_co
                                          • API String ID: 3638413197-1862493962
                                          • Opcode ID: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction ID: c970f6cc1162f0d106d27565064d24bae80cc5d647643b18d1f9b1af61abd66d
                                          • Opcode Fuzzy Hash: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                          • Instruction Fuzzy Hash: 58219BB4909701EFC710AF24C18865ABFE4BF88745F41892EE8C993350E7B8D985DF4A
                                          Function 00405DC4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 623 405dc4 624 405dc8-405dd8 call 402ed0 623->624 627 405da4-405dac PyErr_Occurred 624->627 628 405dba-405dc2 free 627->628 629 405dae-405db4 PyErr_Print PyErr_Clear 627->629 630 405d50-405d61 call 401980 628->630 629->628 633 405de0-405de9 630->633 634 405d63-405d6c 630->634 634->630 636 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 634->636 636->624 639 405d93-405da2 PyImport_ExecCodeModule 636->639 639->624 639->627
                                          APIs
                                          Strings
                                          • Module object for %s is NULL!, xrefs: 00405DCC
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$ClearCodeExecFromImport_Marshal_ModuleObjectOccurredPrintReadStringfree
                                          • String ID: Module object for %s is NULL!
                                          • API String ID: 2954924069-1939177074
                                          • Opcode ID: 7f3ff4246443669002559e413b6afe45e893b7647b27d817c239185db9502501
                                          • Instruction ID: 5b8f683c50dc34ce5f11ffbd1f02edeffe67dd040c89a12bc9db49ded73bce97
                                          • Opcode Fuzzy Hash: 7f3ff4246443669002559e413b6afe45e893b7647b27d817c239185db9502501
                                          • Instruction Fuzzy Hash: 3A01D3B0609B00DBC7206F25D54926BBBE1EE44740F45882FE489D6291DB788882DF5A
                                          Function 0040EF90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 640 40ef90-40efaa 641 40efd8-40efea fgetpos 640->641 642 40efac-40efaf 640->642 643 40f03c-40f041 641->643 644 40efec-40eff4 641->644 645 40f000-40f028 fflush _fileno _filelengthi64 642->645 646 40efb1-40efb3 642->646 648 40efcd-40efd4 643->648 644->645 647 40efc1-40efc8 fsetpos 644->647 645->647 649 40efb5-40efbd 646->649 650 40f02a-40f03a _errno 646->650 647->648 649->647 650->648
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
                                          • String ID:
                                          • API String ID: 4183758535-0
                                          • Opcode ID: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction ID: 4b13233adec89eef7c79cf0ca00fcee1fa5ec0274880c3d786e8fbaf61c832b7
                                          • Opcode Fuzzy Hash: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                          • Instruction Fuzzy Hash: 7A113DB15087059BC310AF2A958105FBBE4EF91354F120D3FF89493292E239D999CB96
                                          Function 00405D4C Relevance: 9.0, APIs: 6, Instructions: 35COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 651 405d4c 652 405d50-405d61 call 401980 651->652 655 405de0-405de9 652->655 656 405d63-405d6c 652->656 656->652 658 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 656->658 661 405d93-405da2 PyImport_ExecCodeModule 658->661 662 405dc8-405dd8 call 402ed0 658->662 661->662 663 405da4-405dac PyErr_Occurred 661->663 662->663 665 405dba-405dc2 free 663->665 666 405dae-405db4 PyErr_Print PyErr_Clear 663->666 665->652 666->665
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$ClearCodeExecFromImport_Marshal_ModuleObjectOccurredPrintReadStringfree
                                          • String ID:
                                          • API String ID: 2954924069-0
                                          • Opcode ID: adc5dfaa51ca1f11fe256012238351c5b7b9446f2bef57875ae31e97d593283a
                                          • Instruction ID: cbea3933326be5ba74a4cecacd0323492524317ff469b2c4e41e1fb4f155b449
                                          • Opcode Fuzzy Hash: adc5dfaa51ca1f11fe256012238351c5b7b9446f2bef57875ae31e97d593283a
                                          • Instruction Fuzzy Hash: E901D6B0605B01DFC7206F25994822BBBE1EE44740B45883FE999D7291DB78C842DF5A
                                          Function 00408550 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 668 408550-40856b malloc 669 408571-40858f call 40ef60 668->669 670 4086b8-4086ba 668->670 669->670 674 408595-4085b8 call 40f050 669->674 671 4086bc-4086cf free 670->671 674->670 677 4085be-4085d2 674->677 678 4085d6-4085ec 677->678 679 4085fe-40861d 678->679 680 4085ee-4085f6 678->680 681 4086b2-4086b4 679->681 682 408623-40863d call 40ef60 679->682 680->679 681->670 682->681 685 40863f-40865d fread 682->685 685->681 686 40865f-408666 685->686 687 408690-408692 686->687 688 408670-40868c memcmp 687->688 689 408694-4086ac 687->689 690 4086d0-4086e6 688->690 691 40868e 688->691 689->678 689->681 690->671 691->687
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freadfreemalloc
                                          • String ID:
                                          • API String ID: 2848089211-0
                                          • Opcode ID: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction ID: cab96f3465d474487508a1ec879676b61213e1df38a8e45f68965f676f42926a
                                          • Opcode Fuzzy Hash: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                          • Instruction Fuzzy Hash: 78413B716083118BC710DF29C58060FFBE1AFC8354F168E2EF9D897391EA79D8498B86
                                          Function 0040EFF6 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _filelengthi64_filenofflushfsetpos
                                          • String ID:
                                          • API String ID: 1406207278-0
                                          • Opcode ID: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction ID: 1330b5d8d42a305a2191b976321c9ddfa34460ad39984d8d2968ac2a071300d9
                                          • Opcode Fuzzy Hash: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                          • Instruction Fuzzy Hash: 5BE0EDB2908B158BC700BF66A88119DFBE0FF80358F134C2FE4D953212E638A5D58B86
                                          Function 004017F4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ferrorfwrite
                                          • String ID: Failed to extract %s: decompression resulted in return code %d!
                                          • API String ID: 2451956730-2259475180
                                          • Opcode ID: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction ID: 3822a968a1abd095370c554b2ca83eb16347efd21d9f73064333f8d65a1dff39
                                          • Opcode Fuzzy Hash: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                          • Instruction Fuzzy Hash: 5AF01CB56097008BC710BF29E48105EBBE1FF81324F528A2EF5E897381D739D8818B86
                                          Function 004044F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wstat.MSVCRT ref: 00404527
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide_wstat
                                          • String ID: vW@
                                          • API String ID: 35547977-739985395
                                          • Opcode ID: f68f487c7fc98f073bf5515ade25dc7e50f262739ba4e39397ed4c0b26112309
                                          • Instruction ID: a5fa3471d1d6b00994ce1f6807dd4af604ac1712bdf86b7583ceec80064c9dbb
                                          • Opcode Fuzzy Hash: f68f487c7fc98f073bf5515ade25dc7e50f262739ba4e39397ed4c0b26112309
                                          • Instruction Fuzzy Hash: 79E0E5B08093009BC700EF7AC58925ABBE4BB88384F808C2DB488C3291E7398548CB52
                                          Function 00401124 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __wgetmainargs
                                          • String ID: B
                                          • API String ID: 1709950718-3394935788
                                          • Opcode ID: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction ID: 27c32f95ce735926b30c16c90320b224d17bcd53438576fbaefc61be872f07d1
                                          • Opcode Fuzzy Hash: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                          • Instruction Fuzzy Hash: 81E092B1A04711EFC714DF25E645246BBE0BB48308F81D91EE69897210D3B9A549DF8A
                                          Function 0040A3F0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID: 8
                                          • API String ID: 2803490479-4194326291
                                          • Opcode ID: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction ID: 3d9a3cba30c8a6cce76611aecb6f7ccedd9577938697bd5609853f48fc3db6fb
                                          • Opcode Fuzzy Hash: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                          • Instruction Fuzzy Hash: 542159B45083018FDB10DF29C5886267BE0AF48314F51866EA8499B3C5E3B8CC65CF47
                                          Function 00408100 Relevance: 3.0, APIs: 2, Instructions: 22libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • LoadLibraryExW.KERNEL32 ref: 00408136
                                          • free.MSVCRT(?,?,?,?,?,00000000), ref: 00408144
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharLibraryLoadMultiWidefree
                                          • String ID:
                                          • API String ID: 3231889924-0
                                          • Opcode ID: 5d8565fb56928c0b2a339ae78370c30edaeabbfce472f749a9e73ddc86dce43c
                                          • Instruction ID: 9c98291bb8aeede50614ca81ae0f1542a833f490e58002a57af99077e474df99
                                          • Opcode Fuzzy Hash: 5d8565fb56928c0b2a339ae78370c30edaeabbfce472f749a9e73ddc86dce43c
                                          • Instruction Fuzzy Hash: 72E0E5F19093009BDB00BF78E58934BBEE0AB44344F02892DE4C88B341E67988448B82
                                          Function 004018B6 Relevance: 2.5, APIs: 2, Instructions: 19COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction ID: 37d18b623566974bb2935c6215979c875cfe96a297bc96d00919041d074b5ac9
                                          • Opcode Fuzzy Hash: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                          • Instruction Fuzzy Hash: 80E0E6B6604715CBCB107F65F48119DF7E0FF41328F124A3FE9E493291D639A5454B86
                                          Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • _wfopen.MSVCRT ref: 00404703
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide_wfopen
                                          • String ID:
                                          • API String ID: 372205238-0
                                          • Opcode ID: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction ID: 3468f0b4211825adde8639be08c033172f5b0e4316271c3a96c81e3ef559f4c6
                                          • Opcode Fuzzy Hash: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                          • Instruction Fuzzy Hash: 2FF0F2B04193009FC314FF28D58868EBBE8FF88348F018C2EF5C897252D6789549CB92
                                          Function 0040A4B1 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID:
                                          • API String ID: 2803490479-0
                                          • Opcode ID: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction ID: 34294cd6affbb3e785c4932bfc48d0f633533baf833ca0b38d678e79e0ec05fd
                                          • Opcode Fuzzy Hash: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                          • Instruction Fuzzy Hash: 87011EB45053018FDB54DF19C184356BBE0FF88304F55896EE8889B385D3B8C855CF46

                                          Non-executed Functions

                                          Function 004011B3 Relevance: 9.1, APIs: 6, Instructions: 119sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterSleepUnhandled__p__wcmdln_amsg_exit_inittermmemcpy
                                          • String ID:
                                          • API String ID: 527270645-0
                                          • Opcode ID: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                          • Instruction ID: 9529fa1fa00849a3a4482e99920bc3e8817caf8231a65d9ae2bb721758bc0f10
                                          • Opcode Fuzzy Hash: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                          • Instruction Fuzzy Hash: 45414DB4A043018FDB20EFA9D98475AB7F0FB44344F51453EE985A73B0DBB89845CB89
                                          Function 00401170 Relevance: 7.6, APIs: 5, Instructions: 135sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                          • String ID:
                                          • API String ID: 1204267290-0
                                          • Opcode ID: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                          • Instruction ID: 683df0bb935b0ba919073670d03ce8182cb7faa8ee4b460d1895c998537b4a50
                                          • Opcode Fuzzy Hash: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                          • Instruction Fuzzy Hash: 0C5180B0A043019FDB20DFA8D984B5AB7F0FB44344F11453EE945AB3B1D7789845CB89
                                          Function 046BE670 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??1QCryptographicHash@@QAE@XZ.QT5CORE ref: 046BE67B
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CryptographicHash@@
                                          • String ID:
                                          • API String ID: 3304500568-0
                                          • Opcode ID: 4555799e68e9de153cea664143818241465cf27e756c38b59afe3a370bbca0d0
                                          • Instruction ID: e8513c34b23cf9e9d2fad0eaf2725686ddf31486b2a0ea946cfaae371500666a
                                          • Opcode Fuzzy Hash: 4555799e68e9de153cea664143818241465cf27e756c38b59afe3a370bbca0d0
                                          • Instruction Fuzzy Hash: BFC08CB2A0363053C8212600B808ADE33188F51A10F0A4006EE042F380EAA82D8243DB
                                          Function 00406D50 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 385libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc
                                          • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                          • API String ID: 190572456-2208601799
                                          • Opcode ID: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                          • Instruction ID: b9744897239d32f33dc6bfef900ed9271cf1591fb07702e628d33a7ecb5ec9b2
                                          • Opcode Fuzzy Hash: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                          • Instruction Fuzzy Hash: C3F108B090A701CBC7106F759A4506EBAF0AE41758F40CA3FB4A49B2C1DB7C9499DB9F
                                          Function 047586E0 Relevance: 105.2, APIs: 34, Strings: 26, Instructions: 216COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0474EB10: ??0QObject@@QAE@PAV0@@Z.QT5CORE(00000000,?), ref: 0474EB21
                                            • Part of subcall function 04752260: PyType_FromSpec.PYTHON3(047FC950,04758728), ref: 04752265
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to initialise pyqtProperty type), ref: 04758731
                                          • PyDict_SetItemString.PYTHON3(?,pyqtProperty), ref: 0475874D
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to set pyqtProperty type), ref: 0475875B
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to initialise pyqtSignal type), ref: 0475876F
                                          • PyDict_SetItemString.PYTHON3(?,pyqtSignal), ref: 04758781
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to set pyqtSignal type), ref: 0475878F
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to initialise pyqtBoundSignal type), ref: 047587A3
                                          • PyDict_SetItemString.PYTHON3(?,pyqtBoundSignal), ref: 047587B5
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to set pyqtBoundSignal type), ref: 047587C3
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to initialise pyqtMethodProxy type), ref: 047587D7
                                          • ?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z.QT5CORE(?,PyQt_PyObject,PyQt_PyObject,00000000,00000001), ref: 047587FA
                                          • ?registerNormalizedTypedef@QMetaType@@SAHABVQByteArray@@H@Z.QT5CORE(?,00000400), ref: 0475882F
                                          • ?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z.QT5CORE(?,04749540,04749520,00000004,00000103,00000000), ref: 04758852
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0475885F
                                          • ?registerStreamOperators@QMetaType@@SAXPBDP6AXAAVQDataStream@@PBX@ZP6AX1PAX@Z@Z.QT5CORE(PyQt_PyObject,047586D0,047586C0), ref: 04758874
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to register attribute getter), ref: 0475889E
                                          • PyUnicode_FromString.PYTHON3(__name__), ref: 047588AF
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to objectify '__name__'), ref: 047588C2
                                          • PyUnicode_FromString.PYTHON3(__mro__), ref: 047588CD
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to objectify '__mro__'), ref: 047588E0
                                          • PyUnicode_FromString.PYTHON3(__pyqtSignature__), ref: 047588EB
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to objectify '__pyqtSignature__'), ref: 047588FE
                                          • PyDict_New.PYTHON3 ref: 04758904
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to create PYQT_CONFIGURATION dict), ref: 04758915
                                          • PyUnicode_FromString.PYTHON3(-n PyQt5.sip -t Qt_5_15_2 -t WS_WIN), ref: 04758920
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to create PYQT_CONFIGURATION.sip_flags), ref: 04758930
                                          • PyDict_SetItemString.PYTHON3(00000000,sip_flags,00000000), ref: 0475893D
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to set PYQT_CONFIGURATION.sip_flags), ref: 0475894B
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04758962
                                          • PyDict_SetItemString.PYTHON3(?,PYQT_CONFIGURATION,00000000), ref: 04758972
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Failed to set PYQT_CONFIGURATION dict), ref: 04758980
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04758997
                                          • ??0QMutex@@QAE@W4RecursionMode@0@@Z.QT5CORE(00000001), ref: 047589AE
                                          • Py_FatalError.PYTHON3(PyQt5.QtCore: Unable to embed qt.conf), ref: 047589C7
                                          Strings
                                          • PyQt5.QtCore: Failed to register attribute getter, xrefs: 04758899
                                          • PyQt_PyObject, xrefs: 047587E1, 047587F4, 04758811, 0475886F
                                          • PyQt5.QtCore: Failed to set pyqtBoundSignal type, xrefs: 047587BE
                                          • sip_flags, xrefs: 04758937
                                          • PyQt5.QtCore: Failed to set PYQT_CONFIGURATION dict, xrefs: 0475897B
                                          • PyQt5.QtCore: Failed to set pyqtSignal type, xrefs: 0475878A
                                          • PyQt5.QtCore: Failed to objectify '__name__', xrefs: 047588BD
                                          • PyQt5.QtCore: Failed to initialise pyqtBoundSignal type, xrefs: 0475879E
                                          • PYQT_CONFIGURATION, xrefs: 0475896C
                                          • PyQt5.QtCore: Failed to set pyqtProperty type, xrefs: 04758756
                                          • PyQt5.QtCore: Failed to initialise pyqtSignal type, xrefs: 0475876A
                                          • pyqtSignal, xrefs: 0475877B
                                          • PyQt5.QtCore: Failed to set PYQT_CONFIGURATION.sip_flags, xrefs: 04758946
                                          • pyqtProperty, xrefs: 04758747
                                          • PyQt5.QtCore: Failed to objectify '__pyqtSignature__', xrefs: 047588F9
                                          • PyQt5.QtCore: Unable to embed qt.conf, xrefs: 047589C2
                                          • __pyqtSignature__, xrefs: 047588E6
                                          • -n PyQt5.sip -t Qt_5_15_2 -t WS_WIN, xrefs: 0475891B
                                          • pyqtBoundSignal, xrefs: 047587AF
                                          • PyQt5.QtCore: Failed to create PYQT_CONFIGURATION.sip_flags, xrefs: 0475892B
                                          • __mro__, xrefs: 047588C8
                                          • PyQt5.QtCore: Failed to initialise pyqtMethodProxy type, xrefs: 047587D2
                                          • __name__, xrefs: 047588AA
                                          • PyQt5.QtCore: Failed to objectify '__mro__', xrefs: 047588DB
                                          • PyQt5.QtCore: Failed to initialise pyqtProperty type, xrefs: 0475872C
                                          • PyQt5.QtCore: Failed to create PYQT_CONFIGURATION dict, xrefs: 04758910
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ErrorFatal$String$Dict_Meta$FromItem$Array@@ByteUnicode_$?registerType@@$DeallocNormalizedObject@@Type@$?normalizedDataFlag@Flags@Mode@0@@Mutex@@Object@@@Operators@RecursionSpecStreamStream@@TypeType@@@@Type_Typedef@V0@@
                                          • String ID: -n PyQt5.sip -t Qt_5_15_2 -t WS_WIN$PYQT_CONFIGURATION$PyQt5.QtCore: Failed to create PYQT_CONFIGURATION dict$PyQt5.QtCore: Failed to create PYQT_CONFIGURATION.sip_flags$PyQt5.QtCore: Failed to initialise pyqtBoundSignal type$PyQt5.QtCore: Failed to initialise pyqtMethodProxy type$PyQt5.QtCore: Failed to initialise pyqtProperty type$PyQt5.QtCore: Failed to initialise pyqtSignal type$PyQt5.QtCore: Failed to objectify '__mro__'$PyQt5.QtCore: Failed to objectify '__name__'$PyQt5.QtCore: Failed to objectify '__pyqtSignature__'$PyQt5.QtCore: Failed to register attribute getter$PyQt5.QtCore: Failed to set PYQT_CONFIGURATION dict$PyQt5.QtCore: Failed to set PYQT_CONFIGURATION.sip_flags$PyQt5.QtCore: Failed to set pyqtBoundSignal type$PyQt5.QtCore: Failed to set pyqtProperty type$PyQt5.QtCore: Failed to set pyqtSignal type$PyQt5.QtCore: Unable to embed qt.conf$PyQt_PyObject$__mro__$__name__$__pyqtSignature__$pyqtBoundSignal$pyqtProperty$pyqtSignal$sip_flags
                                          • API String ID: 2952554106-3785846145
                                          • Opcode ID: a94cf585eb311f48b557cde04abb8ccddaf62778f83f828efcd5514d628d195a
                                          • Instruction ID: 743ff94aa3c39c7e14e3714fe0485fd98e4424bdb702b473e17e529624903fb3
                                          • Opcode Fuzzy Hash: a94cf585eb311f48b557cde04abb8ccddaf62778f83f828efcd5514d628d195a
                                          • Instruction Fuzzy Hash: 7C61B7B0640300BFE7007FA4AC4AE99379CEB44654F054620FD01EA361EBE9B9618EA3
                                          Function 047506E0 Relevance: 77.4, APIs: 40, Strings: 4, Instructions: 434COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 047506F2
                                          • PyObject_GetAttr.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,04750CA5,?,?,?,?), ref: 0475073E
                                          • _Py_Dealloc.PYTHON3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?), ref: 04750781
                                          • ??4QByteArray@@QAEAAV0@PBD@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?), ref: 0475079B
                                          • _Py_Dealloc.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?), ref: 047507B6
                                          • PyObject_GetAttr.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?), ref: 047507C5
                                          • PyList_Size.PYTHON3(00000000), ref: 047507EF
                                          • PyList_GetItem.PYTHON3(00000000,00000000), ref: 04750804
                                          • PyList_Size.PYTHON3(?), ref: 04750897
                                          • ??4QByteArray@@QAEAAV0@ABV0@@Z.QT5CORE(00000008), ref: 047508BA
                                          • ?prepend@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000031), ref: 047508C4
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 047508E9
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 047508FD
                                          • PyErr_Format.PYTHON3(6C969584,decorated slot has no signature compatible with %s,00000000), ref: 04750910
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0475091F
                                          • ??4QByteArray@@QAEAAV0@PBD@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?,?), ref: 04750980
                                          • ?endsWith@QByteArray@@QBE_ND@Z.QT5CORE(0000005F,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?,?), ref: 0475098C
                                          • ?chop@QByteArray@@QAEXH@Z.QT5CORE(00000001,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?,?), ref: 0475099C
                                          • PyImport_ImportModule.PYTHON3(functools,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?,?), ref: 047509D4
                                          • PyObject_GetAttrString.PYTHON3(00000000,partial,?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5), ref: 047509E9
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04750A09
                                          • PyObject_IsInstance.PYTHON3(?,007246F8,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?), ref: 04750A23
                                          • PyObject_GetAttrString.PYTHON3(?,func), ref: 04750A46
                                          • _Py_Dealloc.PYTHON3(?), ref: 04750A63
                                          • PyObject_IsInstance.PYTHON3(00000000), ref: 04750A7D
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04750AED
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04750B40
                                          • PyErr_Clear.PYTHON3 ref: 04750B45
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 04750B99
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000028), ref: 04750BA5
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(0000002C), ref: 04750BBA
                                          • ?append@QByteArray@@QAEAAV1@ABV1@@Z.QT5CORE(?), ref: 04750BD3
                                          • ?append@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000029), ref: 04750BE0
                                          • ??4QByteArray@@QAEAAV0@$$QAV0@@Z.QT5CORE(?), ref: 04750BED
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 04750BF7
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 04750BFF
                                          • ?indexOfSlot@QMetaObject@@QBEHPBD@Z.QT5CORE(00000000), ref: 04750C0A
                                          • ?clear@QByteArray@@QAEXXZ.QT5CORE ref: 04750C16
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,04750CA5,?), ref: 04750C2B
                                          • ?prepend@QByteArray@@QAEAAV1@D@Z.QT5CORE(00000031), ref: 04750C3D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$Dealloc$Object_$?append@Attr$List_V0@@$?const?prepend@Data@Err_InstanceSizeString$?chop@?clear@?ends?indexClearFormatImportImport_ItemMetaModuleObject@@Slot@V0@$$V1@@With@
                                          • String ID: decorated slot has no signature compatible with %s$func$functools$partial
                                          • API String ID: 910530408-1674786566
                                          • Opcode ID: b439ec08908ccdc375a579aa23d366de25aeb56d292c38a5b9b22f360e623f47
                                          • Instruction ID: 62f7495732671db0b2a3536fc0bb314db0d6198148912d071c8ab35ae31f51fe
                                          • Opcode Fuzzy Hash: b439ec08908ccdc375a579aa23d366de25aeb56d292c38a5b9b22f360e623f47
                                          • Instruction Fuzzy Hash: 51F17B715043458FC710DF28D884AAAB7E9FF89314F184928FD569B3A0E7B5BD06CB92
                                          Function 04754520 Relevance: 50.9, APIs: 24, Strings: 5, Instructions: 149COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QObject@@QAE@PAV0@@Z.QT5CORE(00000000,00000000,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 0475452A
                                          • ??0Connection@QMetaObject@@QAE@XZ.QT5CORE(?,?,00000000,?,00000000), ref: 04754539
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,00000000,?,00000000), ref: 04754552
                                          • PyGILState_Ensure.PYTHON3(?,?,00000000,?,00000000), ref: 0475455F
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                            • Part of subcall function 04753D60: PyWeakref_NewRef.PYTHON3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04753DB7
                                          • PyGILState_Release.PYTHON3(00000000,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754581
                                          • ??0QMetaObjectBuilder@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 0475458E
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(PyQtSlotProxy,000000FF,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545A5
                                          • ?setClassName@QMetaObjectBuilder@@QAEXABVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545B0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545BA
                                          • ?setSuperClass@QMetaObjectBuilder@@QAEXPBUQMetaObject@@@Z.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545CA
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(unislot(),000000FF,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545DB
                                          • ?addSlot@QMetaObjectBuilder@@QAE?AVQMetaMethodBuilder@@ABVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545F1
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047545F7
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(disable(),000000FF,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754608
                                          • ?addSlot@QMetaObjectBuilder@@QAE?AVQMetaMethodBuilder@@ABVQByteArray@@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754618
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 0475461E
                                          • ?toMetaObject@QMetaObjectBuilder@@QBEPAUQMetaObject@@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754628
                                          • ?lock@QMutex@@QAEXXZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754641
                                            • Part of subcall function 04754C00: ?detach_helper@QHashData@@QAEPAU1@P6AXPAUNode@1@PAX@ZP6AX0@ZHH@Z.QT5CORE(04754C90,04655610,00000010,00000004,04898650,049C6860,04754651,?,?,?,?,?,?,?,?,00000000), ref: 04754C22
                                            • Part of subcall function 04754C00: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(04655610,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754C4F
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(00110005,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754665
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047546AE
                                          • ?unlock@QMutex@@QAEXXZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 047546D4
                                          • ?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z.QT5CORE(?,?,2destroyed(QObject *),00000000,1disable(),00000002,?,?,?,?,?,?,?,?,00000000,?), ref: 047546EF
                                          • ??1Connection@QMetaObject@@QAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 047546FC
                                          • ??1QMetaObjectBuilder@@UAE@XZ.QT5CORE(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04754707
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Meta$Byte$Builder@@$Array@@Object$Object@@$Data@@Hash$Array@@@Connection@$?add?setMethodMutex@@Slot@State_V0@@$?allocate?connect@?detach_helper@?free_helper@?lock@?rehash@?unlock@ClassClass@ConnectionEnsureName@Node@Node@1@Node@1@@Object@Object@@@Qt@@@ReleaseSuperType@Weakref_malloc
                                          • String ID: 1disable()$2destroyed(QObject *)$PyQtSlotProxy$disable()$unislot()
                                          • API String ID: 3092892276-4214815788
                                          • Opcode ID: b731bab6e323072bef2dd96efafb62cad5ccccc238f3085d5e77d4cf4a38c418
                                          • Instruction ID: 1690703f4b63011546fd0be2672ffdcd147afa4b60dde8239bf807d2882f9c68
                                          • Opcode Fuzzy Hash: b731bab6e323072bef2dd96efafb62cad5ccccc238f3085d5e77d4cf4a38c418
                                          • Instruction Fuzzy Hash: DE517D71504301DFD704DF20E8889AA7BF8FF88314B148A69E8569B2A1DBB4FE45CF91
                                          Function 004025E0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 234windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                          • String ID: $0$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                          • API String ID: 3223904152-2569830377
                                          • Opcode ID: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                          • Instruction ID: 2067da98e2504e100063f8f35cc28d01e2b4b69eff652bc710e7bd6244d7957c
                                          • Opcode Fuzzy Hash: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                          • Instruction Fuzzy Hash: B7C183B4909301DFE700EF68C19835ABFE0FB88354F10896EE8988B355D7B99548CF96
                                          Function 00405A60 Relevance: 47.4, APIs: 10, Strings: 17, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                          • Py_SetProgramName.PYTHON310 ref: 00405AEC
                                          • Py_SetPythonHome.PYTHON310 ref: 00405B19
                                          • Py_GetPath.PYTHON310 ref: 00405BA6
                                          • Py_SetPath.PYTHON310 ref: 00405BB3
                                          • Py_Initialize.PYTHON310 ref: 00405BC0
                                          • PySys_SetPath.PYTHON310 ref: 00405BCD
                                          • PySys_SetArgvEx.PYTHON310 ref: 00405C0A
                                          • free.MSVCRT ref: 00405C26
                                          • free.MSVCRT ref: 00405C34
                                          • PyErr_Occurred.PYTHON310 ref: 00405C39
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Path$Sys_free$ArgvEnvironmentErr_HomeInitializeNameOccurredProgramPythonVariable
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                          • API String ID: 3602564992-4092346810
                                          • Opcode ID: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                          • Instruction ID: 22c84da25320057bd24c90e3ec615a054902b22b929e7a825a46e5f77c0d8298
                                          • Opcode Fuzzy Hash: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                          • Instruction Fuzzy Hash: B5513BB0609B009BE310AF65D54826BBBE0EF44354F458A2FE9D5A72D1C7BC8485CF9B
                                          Function 04704680 Relevance: 47.4, APIs: 23, Strings: 4, Instructions: 125timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isNull@QDateTime@@QBE_NXZ.QT5CORE ref: 047046AB
                                          • PyUnicode_FromString.PYTHON3(PyQt5.QtCore.QDateTime()), ref: 047046BA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DateFromNull@StringTime@@Unicode_
                                          • String ID: , %i$, PyQt5.QtCore.Qt.TimeSpec(%i)$PyQt5.QtCore.QDateTime(%i, %i, %i, %i, %i$PyQt5.QtCore.QDateTime()
                                          • API String ID: 3567112591-3180685923
                                          • Opcode ID: ac72414a97749cdb58969fa6d7f02af4d2a21609f59a309be04162513a2c3c37
                                          • Instruction ID: c31c58fdff15166bc32bd24afba3ff91149add73c5024823904c633c98a8e37b
                                          • Opcode Fuzzy Hash: ac72414a97749cdb58969fa6d7f02af4d2a21609f59a309be04162513a2c3c37
                                          • Instruction Fuzzy Hash: 83416DB25003059FD711EB74EC49DEF37ACFF84658B044A58F54686291EF69EA08CBA2
                                          Function 04662770 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 312COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyObject_GetIter.PYTHON3(?), ref: 0466277A
                                          • PyErr_Clear.PYTHON3 ref: 04662790
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 046627AB
                                          • PyType_GetFlags.PYTHON3(?), ref: 046627B7
                                          • PyErr_Clear.PYTHON3(00000004), ref: 04662800
                                          • PyIter_Next.PYTHON3(00000000), ref: 04662807
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 04662892
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(00000000), ref: 046628C3
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(00000000), ref: 04662903
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(?,?), ref: 0466294C
                                          • ??0QUrl@@QAE@ABV0@@Z.QT5CORE(00000000), ref: 0466295D
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 04662961
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04662999
                                          • PyErr_Clear.PYTHON3 ref: 046629A6
                                          • PyIter_Next.PYTHON3(00000000), ref: 046629AD
                                          • PyErr_Occurred.PYTHON3 ref: 046629C7
                                          • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 04662A15
                                          • PyErr_Format.PYTHON3(6C969584,index %zd has type '%s' but 'QUrl' is expected,?,00000000), ref: 04662A54
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04662A74
                                          • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 04662AC4
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04662AE4
                                          Strings
                                          • index %zd has type '%s' but 'QUrl' is expected, xrefs: 04662A4D
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Dealloc$Err_$Url@@V0@@$Clear$Data@@Iter_ListNext$?append@?detach_grow@Data@1@FlagsFormatIterObject_OccurredType_
                                          • String ID: index %zd has type '%s' but 'QUrl' is expected
                                          • API String ID: 3433903643-1287453159
                                          • Opcode ID: 0bbc2d5cb3e7d8ae2a646f52de11d84410a3d6be7e8f10bfb1cec364d685ff7c
                                          • Instruction ID: f8a5205607a559eb862c8a27636d9b4d141bfde67b2880111bad085dbff86dfe
                                          • Opcode Fuzzy Hash: 0bbc2d5cb3e7d8ae2a646f52de11d84410a3d6be7e8f10bfb1cec364d685ff7c
                                          • Instruction Fuzzy Hash: 9CB1C0715003019FDB24EF28D890A6A77A4FF94324F184658F86A9B390E775FD56CB82
                                          Function 0466A710 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 297COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyObject_GetIter.PYTHON3(?), ref: 0466A720
                                          • PyErr_Clear.PYTHON3 ref: 0466A735
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 0466A754
                                          • PyType_GetFlags.PYTHON3(?), ref: 0466A760
                                          • PyErr_Clear.PYTHON3(00000004), ref: 0466A7A3
                                          • PyIter_Next.PYTHON3(00000000), ref: 0466A7AA
                                          • PyErr_Clear.PYTHON3 ref: 0466A7C1
                                          • PyFloat_AsDouble.PYTHON3(00000000), ref: 0466A7C8
                                          • PyErr_Occurred.PYTHON3 ref: 0466A7D5
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 0466A818
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 0466A8F5
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 0466A924
                                          • PyErr_Clear.PYTHON3 ref: 0466A931
                                          • PyIter_Next.PYTHON3(?), ref: 0466A93C
                                          • PyErr_Occurred.PYTHON3 ref: 0466A953
                                          • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 0466A9A2
                                          • PyErr_Format.PYTHON3(6C969584,index %zd has type '%s' but 'float' is expected,?,00000000), ref: 0466A9DF
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 0466A9FF
                                          • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 0466AA55
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 0466AA6D
                                          Strings
                                          • index %zd has type '%s' but 'float' is expected, xrefs: 0466A9D8
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Err_$Dealloc$Clear$Data@@Iter_ListNextOccurred$?append@?detach_grow@Data@1@DoubleFlagsFloat_FormatIterObject_Type_malloc
                                          • String ID: index %zd has type '%s' but 'float' is expected
                                          • API String ID: 3304316857-3213121333
                                          • Opcode ID: ed86f27fdf6283d71dacc16147c9ad1110608cfd69a0c449ce9d2f1f6b469013
                                          • Instruction ID: 0bb04aa99a4577c38e86c525aac544ecad82d9810af69a17f80955895181cae2
                                          • Opcode Fuzzy Hash: ed86f27fdf6283d71dacc16147c9ad1110608cfd69a0c449ce9d2f1f6b469013
                                          • Instruction Fuzzy Hash: 93B103B19003018FDB10DFA8D84065AB7A4FF56324B154B29E96AEB390F771FD56CB82
                                          Function 04650700 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 249COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyObject_GetIter.PYTHON3(?), ref: 0465070A
                                          • PyErr_Clear.PYTHON3 ref: 0465071C
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04650737
                                          • PyType_GetFlags.PYTHON3(?), ref: 04650743
                                          • PyErr_Clear.PYTHON3(00000004), ref: 04650787
                                          • PyIter_Next.PYTHON3(00000000), ref: 0465078E
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(CCCCCCCD,?,?), ref: 0465081A
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,?), ref: 0465083A
                                          • _Py_Dealloc.PYTHON3(00000000,?,?), ref: 04650874
                                          • PyErr_Clear.PYTHON3 ref: 0465087D
                                          • PyIter_Next.PYTHON3(00000000), ref: 04650884
                                          • PyErr_Occurred.PYTHON3 ref: 04650897
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_00015610), ref: 046508CA
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 046508EC
                                          • PyErr_Format.PYTHON3(6C969584,index %zd has type '%s' but 'QAbstractState' is expected,?,00000000), ref: 04650927
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04650941
                                          • ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_00015610), ref: 0465096B
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04650995
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 046509B5
                                          Strings
                                          • index %zd has type '%s' but 'QAbstractState' is expected, xrefs: 04650920
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Dealloc$Err_$Data@@Hash$Clear$?free_helper@Iter_NextNode@1@@$?allocate?rehash@FlagsFormatIterNode@Object_OccurredType_
                                          • String ID: index %zd has type '%s' but 'QAbstractState' is expected
                                          • API String ID: 4244548230-3746736797
                                          • Opcode ID: dc7f750f85bf644ae31c355405c07e8e5cb94163c801cc7a1e170b45bd80200b
                                          • Instruction ID: d4019ad4162dd9ae2ce09285a396511947761fdb54e9720bd948d95b46c045f4
                                          • Opcode Fuzzy Hash: dc7f750f85bf644ae31c355405c07e8e5cb94163c801cc7a1e170b45bd80200b
                                          • Instruction Fuzzy Hash: 5881DD715003019FDB10DF28D884AAA77A8FF49324F144A68FD69CB3A0F735E916CB92
                                          Function 00405C49 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • Py_SetProgramName.PYTHON310 ref: 00405AEC
                                          • Py_SetPythonHome.PYTHON310 ref: 00405B19
                                          • Py_GetPath.PYTHON310 ref: 00405BA6
                                          • Py_SetPath.PYTHON310 ref: 00405BB3
                                          • Py_Initialize.PYTHON310 ref: 00405BC0
                                          • PySys_SetPath.PYTHON310 ref: 00405BCD
                                            • Part of subcall function 00408C20: calloc.MSVCRT ref: 00408C3D
                                            • Part of subcall function 00408C20: free.MSVCRT ref: 00408C88
                                            • Part of subcall function 00408C20: free.MSVCRT ref: 00408C96
                                          • PySys_SetArgvEx.PYTHON310 ref: 00405C0A
                                          • free.MSVCRT ref: 00405C26
                                          • free.MSVCRT ref: 00405C34
                                          • PyErr_Occurred.PYTHON310 ref: 00405C39
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$Path$Sys_$ArgvByteCharErr_HomeInitializeMultiNameOccurredProgramPythonWidecalloc
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$\$\$base_library.zip$lib-dynload
                                          • API String ID: 486745808-2560864920
                                          • Opcode ID: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                          • Instruction ID: 4f34d637e5975f622271dbaeae991fb6a0a455f2055f84ceed78d6860252850e
                                          • Opcode Fuzzy Hash: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                          • Instruction Fuzzy Hash: EF414AB0609711DFE310AF21E94825BBBE4FF48344F41882EE9C997390D7B89586CF5A
                                          Function 00405AA1 Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 86COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Path$Sys_free$ArgvErr_HomeInitializeNameOccurredProgramPython
                                          • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$\$\$base_library.zip$lib-dynload
                                          • API String ID: 364206270-729638271
                                          • Opcode ID: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                          • Instruction ID: 1f7a57bb88f92124875474453c602a743d3be9c2356b80e19fcfa62188903238
                                          • Opcode Fuzzy Hash: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                          • Instruction Fuzzy Hash: A74139B06097109FE310AF20E94825BBBE0FF44344F81882EE9C997390D7B89485CF5A
                                          Function 00401BD0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 151COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                            • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                            • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                          • malloc.MSVCRT ref: 00401C55
                                          • fread.MSVCRT ref: 00401CF4
                                          • free.MSVCRT ref: 00401D25
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                          • Failed to extract %s: failed to read data chunk!, xrefs: 00401D05
                                          • Failed to extract %s: failed to open target file!, xrefs: 00401E1A
                                          • malloc, xrefs: 00401E4B
                                          • fopen, xrefs: 00401E27
                                          • fread, xrefs: 00401D12
                                          • Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00401E40
                                          • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                          • fseek, xrefs: 00401E01
                                          • fwrite, xrefs: 00401DD1
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$fclosestrtok$_wstatfreadfreemallocstrcpy
                                          • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                          • API String ID: 3544345225-666925554
                                          • Opcode ID: 08f377a39da0c69af000f18cf15a2aebcca8549d1e871d3055fab1c273705c1d
                                          • Instruction ID: b5f998b2d191bd7786349188155599ad4440f4e1001f158a4c3b14c5a7e7e59c
                                          • Opcode Fuzzy Hash: 08f377a39da0c69af000f18cf15a2aebcca8549d1e871d3055fab1c273705c1d
                                          • Instruction Fuzzy Hash: 5C510AB05093419BD710EF29C48465FBBE1BF84354F118D2EF8E59B391D778E8858B4A
                                          Function 00407940 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 126COMMON
                                          Download Yara Rule
                                          APIs
                                          • _wputenv_s.MSVCRT ref: 0040798F
                                          • free.MSVCRT ref: 0040799A
                                          • GetTempPathW.KERNEL32(?,00000000,?,?,00407B92), ref: 004079BB
                                          • _getpid.MSVCRT ref: 004079C4
                                          • _wtempnam.MSVCRT ref: 004079F0
                                          • free.MSVCRT ref: 00407A0B
                                          • free.MSVCRT ref: 00407A3D
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                            • Part of subcall function 004077C0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                            • Part of subcall function 004077C0: free.MSVCRT ref: 0040781A
                                            • Part of subcall function 004077C0: _wfullpath.MSVCRT ref: 0040784A
                                            • Part of subcall function 004077C0: wcschr.MSVCRT ref: 00407877
                                            • Part of subcall function 004077C0: wcsncpy.MSVCRT ref: 004078A7
                                            • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078B7
                                            • Part of subcall function 004077C0: wcschr.MSVCRT ref: 004078C7
                                            • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078DD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                          • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                          • API String ID: 2180377646-1116378104
                                          • Opcode ID: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                          • Instruction ID: 01c5aea6ddf612d932d95327d8216bd8a762320b70d46ed771eeb73c9fc8ba7f
                                          • Opcode Fuzzy Hash: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                          • Instruction Fuzzy Hash: 8E41CCB1A0D7008FD710BF65E58536FBBE0AF84744F02882EE5C897242D77D94859B9B
                                          Function 00408D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 108COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D68
                                          • OpenProcessToken.ADVAPI32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D81
                                          • free.MSVCRT ref: 00408D9F
                                          • CloseHandle.KERNEL32 ref: 00408DB0
                                          • _snwprintf.MSVCRT ref: 00408DDE
                                          • LocalFree.KERNEL32 ref: 00408DE7
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                          • CreateDirectoryW.KERNEL32 ref: 00408E3A
                                          • GetTokenInformation.ADVAPI32 ref: 00408E89
                                          • GetLastError.KERNEL32 ref: 00408E92
                                          • calloc.MSVCRT ref: 00408EB0
                                          • GetTokenInformation.ADVAPI32 ref: 00408EDA
                                          • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                          • API String ID: 1339360106-2855260032
                                          • Opcode ID: 20fa4f3d988aa03e25c24d4b52e570da4e7e5180fc1b205961bb6a5cec14814b
                                          • Instruction ID: 945ac7356c52e091193055c5d6ee7abddb38f98d0a82e690350cb517e8796f62
                                          • Opcode Fuzzy Hash: 20fa4f3d988aa03e25c24d4b52e570da4e7e5180fc1b205961bb6a5cec14814b
                                          • Instruction Fuzzy Hash: 2E41C4B05083009FE700AF69D68825EBBE4BF84755F418E2EF8D9A7291D778D548CF86
                                          Function 0040E660 Relevance: 25.7, APIs: 17, Instructions: 174COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setlocale$wcstombs$_strdupfreerealloc
                                          • String ID:
                                          • API String ID: 2293806352-0
                                          • Opcode ID: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                          • Instruction ID: 1138b9a49e69c7a07146da18e6cbb8f4c5af7b9e580f31b8634df38c7834fdfb
                                          • Opcode Fuzzy Hash: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                          • Instruction Fuzzy Hash: 036130709082119BCB10AF66C44536FBBE1EF94344F468D3FE488A7391E77C8891DB9A
                                          Function 00408190 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 107processsynchronizationCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • SetConsoleCtrlHandler.KERNEL32(00000000,?,00000000,?,00404169), ref: 004081DB
                                          • GetStartupInfoW.KERNEL32 ref: 00408203
                                          • _fileno.MSVCRT ref: 0040824E
                                          • _get_osfhandle.MSVCRT ref: 0040825C
                                          • _fileno.MSVCRT ref: 00408277
                                          • _get_osfhandle.MSVCRT ref: 0040827F
                                          • _fileno.MSVCRT ref: 0040829A
                                          • _get_osfhandle.MSVCRT ref: 004082A2
                                          • GetCommandLineW.KERNEL32 ref: 004082B1
                                          • CreateProcessW.KERNEL32 ref: 00408301
                                          • WaitForSingleObject.KERNEL32 ref: 0040831D
                                          • GetExitCodeProcess.KERNEL32 ref: 00408335
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                          • String ID: CreateProcessW$Error creating child process!
                                          • API String ID: 1833775142-3524285272
                                          • Opcode ID: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                          • Instruction ID: e1b98e6d24d483291a0d25806d4a7f2563c0c3411ac3d46acccf3020f7941406
                                          • Opcode Fuzzy Hash: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                          • Instruction Fuzzy Hash: E14195B05083448FD710AF69D58935EBBF0BF84314F418E2EE8D887291D7B99488CF96
                                          Function 00402B80 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 81windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                          • String ID: 8 $@$Unhandled exception in script
                                          • API String ID: 3963799495-1206599369
                                          • Opcode ID: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                          • Instruction ID: 5f7a7bfca591e00baa7cae047d41d3b5615dab244da7dd9e67f68e2e3487ae70
                                          • Opcode Fuzzy Hash: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                          • Instruction Fuzzy Hash: C231E5B05087409FD750EF69D48969FBBE4AF89348F428D2EE58897350DB78D488CB86
                                          Function 00405490 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 133COMMON
                                          Download Yara Rule
                                          Strings
                                          • Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00405697
                                          • pyi-, xrefs: 00405554
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
                                          • API String ID: 0-3625900369
                                          • Opcode ID: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                          • Instruction ID: 53111416b2da41d66908906ea93154b7d6de6c86b10f1f3900d8cec0b1898ba9
                                          • Opcode Fuzzy Hash: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                          • Instruction Fuzzy Hash: 33513CB05097009FD710AF65D98476ABBE0FB45304F82482EE8C8AB391D3BDD885CF5A
                                          Function 004077C0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                          • free.MSVCRT ref: 0040781A
                                            • Part of subcall function 00408FA0: wcslen.MSVCRT ref: 00408FAC
                                          • _wfullpath.MSVCRT ref: 0040784A
                                          • wcschr.MSVCRT ref: 00407877
                                          • wcsncpy.MSVCRT ref: 004078A7
                                          • CreateDirectoryW.KERNEL32 ref: 004078B7
                                          • wcschr.MSVCRT ref: 004078C7
                                          • CreateDirectoryW.KERNEL32 ref: 004078DD
                                          • _wcsdup.MSVCRT ref: 004078F3
                                          Strings
                                          • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00407900
                                          • \, xrefs: 004078BF
                                          • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 0040792E
                                          • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00407920
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                          • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$\
                                          • API String ID: 274989731-3296995943
                                          • Opcode ID: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                          • Instruction ID: b23a07802ca04ce963d90eb9615f597fb6c60bb1e29e7f7f3b36ce21c54aa4ff
                                          • Opcode Fuzzy Hash: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                          • Instruction Fuzzy Hash: 1C315DB1A087018BD3107F69D94935FBAE4BF84344F05883EE9C897381DB79D8459B8B
                                          Function 00408E58 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 86COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ConvertDescriptorInformationSecurityStringToken$CloseCreateDirectoryErrorFreeHandleLastLocal_snwprintfcallocfree
                                          • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                          • API String ID: 2426448178-2855260032
                                          • Opcode ID: cbc9b7a7022e2090bf5412f5cba968d65ad33e5ede0d00afb860ea90c6cf80a8
                                          • Instruction ID: 5ee2362bb1dffc1b92a9066ae5264b9d3527a87a2536074db898feb824fd9f33
                                          • Opcode Fuzzy Hash: cbc9b7a7022e2090bf5412f5cba968d65ad33e5ede0d00afb860ea90c6cf80a8
                                          • Instruction Fuzzy Hash: 8C31D3B05083009FE700AF69D68835EBBE0FF84715F01892EE8D9972A1D778D988CF46
                                          Function 00405E00 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 56stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Unicode_$AppendDecodeFormatFromList_ObjectSys_strlen
                                          • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                          • API String ID: 442992809-2762566162
                                          • Opcode ID: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                          • Instruction ID: 2414ad3c8f8d3fc0fbc978f46c10fd6a42ce83d48acf707811ed1e666cf8afaa
                                          • Opcode Fuzzy Hash: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                          • Instruction Fuzzy Hash: 6A112EB05093009FC710AF69DA8801EBBE4FF84354F45882EE5D897341D7B88481CF9B
                                          Function 00403370 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 220stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004032F0: strchr.MSVCRT ref: 0040332F
                                            • Part of subcall function 004032F0: strcpy.MSVCRT ref: 00403345
                                          • strcmp.MSVCRT ref: 0040351A
                                            • Part of subcall function 00407FD0: feof.MSVCRT ref: 00408033
                                            • Part of subcall function 00407FD0: fread.MSVCRT ref: 00408057
                                            • Part of subcall function 00407FD0: ferror.MSVCRT ref: 00408063
                                            • Part of subcall function 00407FD0: clearerr.MSVCRT ref: 00408074
                                            • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080B8
                                            • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$clearerrfeofferrorfreadstrchrstrcmpstrcpy
                                          • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$\
                                          • API String ID: 3546371548-4129990315
                                          • Opcode ID: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                          • Instruction ID: 8a7e982486c7dae7ba286fda290711f8ff69515a3f7b07f7f3724835a8bf7877
                                          • Opcode Fuzzy Hash: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                          • Instruction Fuzzy Hash: 67A126B0508701AFC710EF26C58415FBBE8BF84755F408A2EF498A7390D778DA858F8A
                                          Function 00403D60 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 316stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004021E0: calloc.MSVCRT ref: 004021F2
                                            • Part of subcall function 004045D0: GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                          • fclose.MSVCRT ref: 00404245
                                            • Part of subcall function 00404670: strcpy.MSVCRT(?,-00000004,00D20E1C,00000002,?,00401600), ref: 00404683
                                            • Part of subcall function 00404670: strlen.MSVCRT ref: 0040468B
                                            • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                          • free.MSVCRT ref: 00403E26
                                            • Part of subcall function 00407770: SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040D7CA), ref: 0040779E
                                            • Part of subcall function 00407770: free.MSVCRT(?,?,-00000004,00D20E1C,00000002,?,00401600), ref: 004077AC
                                          • SetDllDirectoryW.KERNEL32 ref: 00403EA2
                                          • strcmp.MSVCRT ref: 00403EDB
                                          • strcpy.MSVCRT ref: 00403F28
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: EnvironmentVariablefreestrcpy$DirectoryFileModuleNamecallocfclosestrcmpstrlen
                                          • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                          • API String ID: 3041748488-3602715111
                                          • Opcode ID: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                          • Instruction ID: 81834f9b1efb18d84d1230dad00edf6ea56ed27c7a1d01e0e46bb9e00272f83c
                                          • Opcode Fuzzy Hash: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                          • Instruction Fuzzy Hash: 0FD1F8B09097018AD710AF75D58425FBBE8AF84345F01893FE9D8A7381E738D985CF96
                                          Function 00407DD0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00407F82
                                          • WARNING: file already exists but should not: %s, xrefs: 00407F5B
                                          • ERROR: file already exists but should not: %s, xrefs: 00407EF9
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$_wstatstrtok$ByteCharMultiWidefreestrcpy
                                          • String ID: ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s
                                          • API String ID: 439695417-1996835591
                                          • Opcode ID: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                          • Instruction ID: 0d1752cbd12df257bbbd412badab65e831f2b54a7211b67fa555c1920da682f5
                                          • Opcode Fuzzy Hash: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                          • Instruction Fuzzy Hash: DE411CB050D7019AD310AF25D58429EBBE4EF84748F42883EE5C897391DB7CA4849B9B
                                          Function 04654490 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 046544FF
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 04654523
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0465452E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0465455E
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04654570
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0465457F
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046545A6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QSignalTransition$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-2324252613
                                          • Opcode ID: f0b72f9ab43133a0c068bd86c66a50f8c51dea85315654b267441b51dcca65f2
                                          • Instruction ID: 14fa4c775bbf77a5950d16fa190ce770170fe32d0617455f23669b6b208367b1
                                          • Opcode Fuzzy Hash: f0b72f9ab43133a0c068bd86c66a50f8c51dea85315654b267441b51dcca65f2
                                          • Instruction Fuzzy Hash: C5315971504301AFC710DF98DC45EEA77E9FB88310F4848A8F969D7220EB78AE54CB92
                                          Function 04648500 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 0464856F
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 04648593
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0464859E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046485CE
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046485E0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046485EF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 04648616
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QPropertyAnimation$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-1579030957
                                          • Opcode ID: 1fe69af334d29e998852a513e3f3aaef04fdebfd6bc0561b3818c95f477a3532
                                          • Instruction ID: a6192f872ee0a6f94a4b6d7e538b7a80a214271999815e60ec53d0ea7c5e4538
                                          • Opcode Fuzzy Hash: 1fe69af334d29e998852a513e3f3aaef04fdebfd6bc0561b3818c95f477a3532
                                          • Instruction Fuzzy Hash: 92316975504301AFCB14EF58DC45DEA77E9FB88310F488868F859D3221E778AE15CB92
                                          Function 046865D0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 0468663F
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 04686663
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0468666E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0468669E
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046866B0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046866BF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046866E6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QTransposeProxyModel$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-1692141547
                                          • Opcode ID: b70a38e07c93d9ea4e6a51d59ddb81b668c7a943214e3a7dd69f0a32a2663e98
                                          • Instruction ID: a997c2a3ac21f3501542844582b3b56184859f11af1fcf6e3be7fa1ff24dbc7b
                                          • Opcode Fuzzy Hash: b70a38e07c93d9ea4e6a51d59ddb81b668c7a943214e3a7dd69f0a32a2663e98
                                          • Instruction Fuzzy Hash: 2F3169B1604301AFD700EF54DC45EEA77E9FB48710F488968F86AD7220E779AE05CB92
                                          Function 0470E610 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 0470E67F
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 0470E6A3
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0470E6AE
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0470E6DE
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0470E6F0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0470E6FF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0470E726
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QEventTransition$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-1863193867
                                          • Opcode ID: 7202dca0e2eaa611348ce54e17ea99c6ccdbbd37442299cf7f89489697f2fb8b
                                          • Instruction ID: 7e84ea085fed55d7cda1423da2b6d58394d83da75c0334ea4f58413eeda733a0
                                          • Opcode Fuzzy Hash: 7202dca0e2eaa611348ce54e17ea99c6ccdbbd37442299cf7f89489697f2fb8b
                                          • Instruction Fuzzy Hash: 4D316971504301EFC710EF58ED45DEA77E8FB48210F488868F86AC3260E778AE14CB92
                                          Function 046966F0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 0469675F
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 04696783
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0469678E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046967BE
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046967D0
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046967DF
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 04696806
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QTemporaryFile$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-2333795015
                                          • Opcode ID: 6e61f52f333c56a6afce09abb996375a13867ecef48e3891abbb660a876e67df
                                          • Instruction ID: 922e477afd2755bcbbaecaf0f5f4029c7852d20ff2764c310d57a5bb6abf4071
                                          • Opcode Fuzzy Hash: 6e61f52f333c56a6afce09abb996375a13867ecef48e3891abbb660a876e67df
                                          • Instruction Fuzzy Hash: 3D315B71504301AFCB10DF58DD45EEA77E8FB88710F444868F969D6360E779AE18CB92
                                          Function 0465C760 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 0465C7CF
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 0465C7F3
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0465C7FE
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0465C82E
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0465C840
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0465C84F
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0465C876
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QSignalMapper$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-2786772580
                                          • Opcode ID: aeb191706ed080d1b7f28ce18768bbd93f46547a4c99b5860f5b10fd37eb3587
                                          • Instruction ID: e5fbe94e70ba41a5a7e5e1df2dfacc48660315bea2e29a773ade4a4bbf38265d
                                          • Opcode Fuzzy Hash: aeb191706ed080d1b7f28ce18768bbd93f46547a4c99b5860f5b10fd37eb3587
                                          • Instruction Fuzzy Hash: AB3159B1504301AFD710DF98DC45DEA77E9FB48710F484868F96AD7221E778AE14CB92
                                          Function 0464C770 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 0464C7DF
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE ref: 0464C803
                                          • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0464C80E
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0464C83E
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0464C850
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0464C85F
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0464C886
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?const?receivers@Data@FromLongLong_Object@@
                                          • String ID: BP0$QTimeLine$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                          • API String ID: 4260653144-1522447455
                                          • Opcode ID: a9e641fe5eafdcfd6f5125963995abd6384939061bbc228debc16f0ea489e78d
                                          • Instruction ID: a4ef12d07db1ed903b68a04520637d26d92b98299283d40a564d8036e1c0a72f
                                          • Opcode Fuzzy Hash: a9e641fe5eafdcfd6f5125963995abd6384939061bbc228debc16f0ea489e78d
                                          • Instruction Fuzzy Hash: 34316871504301AFDB00EF58DC85DAA7BE9FB88310F454868F86AD6321E778AE05CB92
                                          Function 00405907 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                          • out of memory, xrefs: 00405A3A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$setlocale$DecodeLocale_strdupcalloc
                                          • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                          • API String ID: 474172956-3355598041
                                          • Opcode ID: 82e1e586b294b392402f47a5caf2ca513f1388d1a5a1a0f0118e5191c02fd9f6
                                          • Instruction ID: 3c8cf5d1830a856620667b4546970957c4b2e71bcab9539e8d8fe080ce2f005d
                                          • Opcode Fuzzy Hash: 82e1e586b294b392402f47a5caf2ca513f1388d1a5a1a0f0118e5191c02fd9f6
                                          • Instruction Fuzzy Hash: BD313AB16087118FD710AF69E58526FBBE0EF40318F06482EE9C497341E77DD885CB9A
                                          Function 046EE630 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 249timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toTime@QLocale@@QBE?AVQTime@@ABVQString@@W4FormatType@1@@Z.QT5CORE(00000000,?,?), ref: 046EE6BE
                                          • ?toTime@QLocale@@QBE?AVQTime@@ABVQString@@0@Z.QT5CORE(00000000,?,?), ref: 046EE771
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          • toTime(self, string: Optional[str], format: QLocale.FormatType = QLocale.LongFormat) -> QTimetoTime(self, string: Optional[str], format: Optional[str]) -> QTimetoTime(self, string: Optional[str], format: QLocale.FormatType, cal: QCalendar) -> QTimetoTime(se, xrefs: 046EE942
                                          • toTime, xrefs: 046EE947
                                          • QLocale, xrefs: 046EE94C
                                          • BJ1EJ9, xrefs: 046EE804
                                          • BJ1J1J9, xrefs: 046EE8C8
                                          • BJ1J1, xrefs: 046EE736
                                          • BJ1|E, xrefs: 046EE680
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Locale@@Time@Time@@$FormatString@@String@@0@Type@1@@malloc
                                          • String ID: BJ1EJ9$BJ1J1$BJ1J1J9$BJ1|E$QLocale$toTime$toTime(self, string: Optional[str], format: QLocale.FormatType = QLocale.LongFormat) -> QTimetoTime(self, string: Optional[str], format: Optional[str]) -> QTimetoTime(self, string: Optional[str], format: QLocale.FormatType, cal: QCalendar) -> QTimetoTime(se
                                          • API String ID: 1905927449-2246651790
                                          • Opcode ID: 39c6a98b555fed89007ec750f78ab0f3ae18072dd59b92d53e583d4ce250a477
                                          • Instruction ID: a57a5af9dba36e079ffe38e01196365fbbbff13c35fde4230e6ea6fabdb9bba0
                                          • Opcode Fuzzy Hash: 39c6a98b555fed89007ec750f78ab0f3ae18072dd59b92d53e583d4ce250a477
                                          • Instruction Fuzzy Hash: FB915AB1108202AFD701DF54DC40FABBBF9FB88314F044819FA9596260D77AEE19DB62
                                          Function 0469A6A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?translate@QTranslator@@UBE?AVQString@@PBD00H@Z.QT5CORE(?,?,?,?,?), ref: 0469A776
                                          • ??0QString@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 0469A77F
                                          • ??0QString@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 0469A798
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 0469A7A4
                                          • _Py_Dealloc.PYTHON3(?), ref: 0469A7C5
                                          • _Py_Dealloc.PYTHON3(?), ref: 0469A7DF
                                          • _Py_Dealloc.PYTHON3(?), ref: 0469A7FD
                                          Strings
                                          • QTranslator, xrefs: 0469A82E
                                          • BAAAA|AAi, xrefs: 0469A71A
                                          • translate(self, context: Optional[str], sourceText: Optional[str], disambiguation: Optional[str] = None, n: int = -1) -> str, xrefs: 0469A824
                                          • translate, xrefs: 0469A829
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$Dealloc$E@$$V0@@$?translate@Translator@@
                                          • String ID: BAAAA|AAi$QTranslator$translate$translate(self, context: Optional[str], sourceText: Optional[str], disambiguation: Optional[str] = None, n: int = -1) -> str
                                          • API String ID: 2503246190-3572492907
                                          • Opcode ID: 006ee1557c659354854cabf5118bb42d52e07a84b5d90aec7f659a74cc188a81
                                          • Instruction ID: ffa7937b7acfe4a9cb705de872a45d1139e23f898262ecd37e949919c1b08cf9
                                          • Opcode Fuzzy Hash: 006ee1557c659354854cabf5118bb42d52e07a84b5d90aec7f659a74cc188a81
                                          • Instruction Fuzzy Hash: 4B4170B1204341AFCB10CFA4C881EAB77EDFB88324F144A19F565D73A0E775E9058B52
                                          Function 046DC700 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 99threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046DC762
                                          • ?processEvents@QCoreApplication@@SAXV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z.QT5CORE(?), ref: 046DC770
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046DC777
                                          • PyEval_SaveThread.PYTHON3 ref: 046DC7DE
                                          • ?processEvents@QCoreApplication@@SAXV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@H@Z.QT5CORE(?,?), ref: 046DC7F0
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046DC7F7
                                          Strings
                                          • J1i, xrefs: 046DC7BB
                                          • QCoreApplication, xrefs: 046DC843
                                          • |J1, xrefs: 046DC734
                                          • processEvents, xrefs: 046DC83E
                                          • processEvents(flags: Union[QEventLoop.ProcessEventsFlags, QEventLoop.ProcessEventsFlag] = QEventLoop.ProcessEventsFlag.AllEvents)processEvents(flags: Union[QEventLoop.ProcessEventsFlags, QEventLoop.ProcessEventsFlag], maxtime: int), xrefs: 046DC839
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?processApplication@@CoreEventEventsEvents@Flag@Flags@ProcessRestoreSave$Loop@@@@Loop@@@@@
                                          • String ID: J1i$QCoreApplication$processEvents$processEvents(flags: Union[QEventLoop.ProcessEventsFlags, QEventLoop.ProcessEventsFlag] = QEventLoop.ProcessEventsFlag.AllEvents)processEvents(flags: Union[QEventLoop.ProcessEventsFlags, QEventLoop.ProcessEventsFlag], maxtime: int)$|J1
                                          • API String ID: 1257342113-3581225208
                                          • Opcode ID: 24a8d70f74833cc5ff4a305db190e61b33daedbb86dbbfb50a73b9076ec80626
                                          • Instruction ID: 5d6d3df87d315f22f57bff81b4b893e534e5fac38a9c015471b5d6916a44163f
                                          • Opcode Fuzzy Hash: 24a8d70f74833cc5ff4a305db190e61b33daedbb86dbbfb50a73b9076ec80626
                                          • Instruction Fuzzy Hash: 7D418775104301AFD310DF54DC44E9A7BE9FB88310F008868F96697220E779EE15DFA2
                                          Function 046F65A0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 85threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046F65E0
                                          • ?remove@QFile@@QAE_NXZ.QT5CORE ref: 046F65EC
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046F65F5
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046F65FF
                                          • PyEval_SaveThread.PYTHON3 ref: 046F6645
                                          • ?remove@QFile@@SA_NABVQString@@@Z.QT5CORE(?), ref: 046F6651
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046F665A
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046F667C
                                          Strings
                                          • remove, xrefs: 046F6695
                                          • QFile, xrefs: 046F669A
                                          • remove(self) -> boolremove(fileName: Optional[str]) -> bool, xrefs: 046F6690
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?remove@Bool_File@@FromLongRestoreSave$String@@@
                                          • String ID: QFile$remove$remove(self) -> boolremove(fileName: Optional[str]) -> bool
                                          • API String ID: 1735884220-2648649929
                                          • Opcode ID: 6b3d751640fa878d662b4724b1cf98f7dfc8374f1ebeda49d41e55e7ea0a1994
                                          • Instruction ID: d396480210ca2c45f0f830f623ee2efeb03cc6889331e17f5f9cb14b17a8a91e
                                          • Opcode Fuzzy Hash: 6b3d751640fa878d662b4724b1cf98f7dfc8374f1ebeda49d41e55e7ea0a1994
                                          • Instruction Fuzzy Hash: CA215C71544301AFC700EFA4EC48EDA7BECFB48215F444869F954D7210E279AA18CFA2
                                          Function 04676740 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyType_GetFlags.PYTHON3(?), ref: 04676753
                                          • ??0QJsonObject@@QAE@XZ.QT5CORE ref: 04676776
                                          • PyDict_Next.PYTHON3(?,?,00000000,?), ref: 04676799
                                          • ?insert@QJsonObject@@QAE?AViterator@1@ABVQString@@ABVQJsonValue@@@Z.QT5CORE(?,00000000,00000000), ref: 0467680D
                                          • PyDict_Next.PYTHON3(?,?,?,?), ref: 04676853
                                          Strings
                                          • a key has type '%s' but 'str' is expected, xrefs: 046768DB
                                          • a value has type '%s' but 'QJsonValue' is expected, xrefs: 0467689A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Json$Dict_NextObject@@$?insert@FlagsString@@Type_Value@@@Viterator@1@
                                          • String ID: a key has type '%s' but 'str' is expected$a value has type '%s' but 'QJsonValue' is expected
                                          • API String ID: 2756388829-3058644961
                                          • Opcode ID: 966fdf2789c4a0a86d2d91f80a639d4a57f37f6266fd5b6646802990ddda5562
                                          • Instruction ID: 6d9a986ebf3db4aa5475f306b8477b9004e21d84b9f8c65663844061dad3554c
                                          • Opcode Fuzzy Hash: 966fdf2789c4a0a86d2d91f80a639d4a57f37f6266fd5b6646802990ddda5562
                                          • Instruction Fuzzy Hash: E4515E72104200AFD710DF58DC84EAA7BE9FB88314F448959FA55C7221E77AEE14DB62
                                          Function 00402370 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 145COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                          • String ID: P%
                                          • API String ID: 2147705588-2959514604
                                          • Opcode ID: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                          • Instruction ID: ab84631f0651d0ee5a96381c4044ee0ed1be7ca295fb525e9842aa76770568ef
                                          • Opcode Fuzzy Hash: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                          • Instruction Fuzzy Hash: FE51F8B19083108FC714EF29D58826ABBF0BF88711F45897EFC898B356E7788544DB62
                                          Function 0040D980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • VirtualProtect failed with code 0x%x, xrefs: 0040DAE6
                                          • Address %p has no image-section, xrefs: 0040DB2B
                                          • VirtualQuery failed for %d bytes at address %p, xrefs: 0040DB17
                                          • Mingw-w64 runtime failure:, xrefs: 0040D9A8
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: QueryVirtualabortfwritevfprintf
                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                          • API String ID: 2513968241-1534286854
                                          • Opcode ID: 69dd2dc4324f01b3bcb49cc819a7a143dff0d4cc5149ad4f68664ebf5ddb0b11
                                          • Instruction ID: 12c366034f147c51322be65863a430c13289ac5cb36f6d5ee6a9828dd919d681
                                          • Opcode Fuzzy Hash: 69dd2dc4324f01b3bcb49cc819a7a143dff0d4cc5149ad4f68664ebf5ddb0b11
                                          • Instruction Fuzzy Hash: C7514EB19083018FC710EF69D88565BFBF0FF84354F45896EE88997255E738E844CB9A
                                          Function 04756490 Relevance: 16.7, APIs: 11, Instructions: 236threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyType_GetSlot.PYTHON3(?,00000030,?,?,?,047562A5,?,?,?,?,?,?), ref: 047564AA
                                          • PyEval_SaveThread.PYTHON3(?,?,?,?,?,?,?,?,?,047562A5,?,?,?,?,?,?), ref: 04756528
                                          • ?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z.QT5CORE(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,047562A5,?,?), ref: 04756539
                                          • PyEval_RestoreThread.PYTHON3(00000000,?,?,?,?,?,?,?,?,?,047562A5,?,?,?,?,?), ref: 04756540
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Object@@Thread$?activate@MetaRestoreSaveSlotType_
                                          • String ID:
                                          • API String ID: 2549544538-0
                                          • Opcode ID: fb8c84a903bb05830fa1d1378dbddf5b65ccbfdb44608eadf87bfb762b66563e
                                          • Instruction ID: be4fc63ba819f317fdecbe7b7c348b57cef333a92bcc24407a545466ae3e4c66
                                          • Opcode Fuzzy Hash: fb8c84a903bb05830fa1d1378dbddf5b65ccbfdb44608eadf87bfb762b66563e
                                          • Instruction Fuzzy Hash: 6F81D231600201AFC724CF6CC88496ABBA5EF85324B588668FC5D9F365DB72FD52CB91
                                          Function 004061B0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 143stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Cannot allocate memory for necessary files., xrefs: 0040639F
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: memcpystrncpy$malloc$callocfreestrlenstrncat
                                          • String ID: Cannot allocate memory for necessary files.
                                          • API String ID: 1441568290-2795144771
                                          • Opcode ID: 911552b35a245790c964822b8ef5d942a4fe4b7b21c60f757b82a0e17b75a1fd
                                          • Instruction ID: 3dc4d87da5770e9ddebe32c392722ba7e048c8290a166a4e568edb3e8c8cc1ad
                                          • Opcode Fuzzy Hash: 911552b35a245790c964822b8ef5d942a4fe4b7b21c60f757b82a0e17b75a1fd
                                          • Instruction Fuzzy Hash: F35105B16093018FC714EF65C08469ABBE4FF88314F12892EE9C997351E778E588CB86
                                          Function 00406410 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • SPLASH: Cannot extract requirement %s., xrefs: 00406629
                                          • SPLASH: Cannot find requirement %s in archive., xrefs: 0040653D
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlenstrncpy$callocfreememcpystrcmp
                                          • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
                                          • API String ID: 1148940474-4094522769
                                          • Opcode ID: 6f7344fd9e2b8a238fed55bc04f9f176e9703f704dcf6b52d8a3a35027e7dce5
                                          • Instruction ID: eeb11d6563064941a90a30efff23fdfd712fb47c201b2447917d1c532d445a23
                                          • Opcode Fuzzy Hash: 6f7344fd9e2b8a238fed55bc04f9f176e9703f704dcf6b52d8a3a35027e7dce5
                                          • Instruction Fuzzy Hash: 8B51E4B05097059FC324EF25D58529FFBE0BF84744F02882EEAC997352D7789884DB96
                                          Function 0474E530 Relevance: 16.6, APIs: 11, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyDict_Next.PYTHON3(00000000,?,00000000,?), ref: 0474E560
                                          • PyErr_Clear.PYTHON3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,0474DB12,?,?), ref: 0474E58C
                                          • PyErr_Occurred.PYTHON3(?,?,?,?,?,?,?,?,?,?,0474DB12,?,?), ref: 0474E5A5
                                          • ??0QByteArray@@QAE@PBDH@Z.QT5CORE(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,0474DB12,?,?), ref: 0474E5D8
                                            • Part of subcall function 0474DE20: ?detach_helper@QHashData@@QAEPAU1@P6AXPAUNode@1@PAX@ZP6AX0@ZHH@Z.QT5CORE(Function_0010DEF0,Function_0010DDB0,00000010,00000004,00000000,0474E87B,0474DA23,?,?,04757500,?,?), ref: 0474DE42
                                            • Part of subcall function 0474DE20: ?free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z.QT5CORE(Function_0010DDB0,?,?,04757500,?,?), ref: 0474DE6F
                                          • ?qHash@@YAIABVQByteArray@@I@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,0474DB12,?,?), ref: 0474E5F6
                                          • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,00000000), ref: 0474E62D
                                          • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,00000000), ref: 0474E648
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0474DB12,?), ref: 0474E664
                                          • ??1QByteArray@@QAE@XZ.QT5CORE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0474DB12), ref: 0474E67E
                                          • _Py_Dealloc.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0474DB12,?), ref: 0474E699
                                          • PyDict_Next.PYTHON3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0474DB12,?), ref: 0474E6B5
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteData@@Hash$Dict_Err_Next$?allocate?detach_helper@?free_helper@?rehash@ClearDeallocHash@@Node@Node@1@Node@1@@OccurredV0@@
                                          • String ID:
                                          • API String ID: 626978164-0
                                          • Opcode ID: f6ac06458adb40354c0d095f09f52d5ab98747ce2205e4f27811ea3b29d55bd6
                                          • Instruction ID: a3e89ddef6ac956eb0980da652bb8c7baed57d6301964948c54f9cba82bfca68
                                          • Opcode Fuzzy Hash: f6ac06458adb40354c0d095f09f52d5ab98747ce2205e4f27811ea3b29d55bd6
                                          • Instruction Fuzzy Hash: FD413BB16043019FC704DF64D8489AAB7E9FF84324F04896EF85697351EB35ED49CBA2
                                          Function 04686470 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 125threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyErr_SetString.PYTHON3(6C969C54,maximum length of data to be read cannot be negative), ref: 046864F9
                                          • PyEval_SaveThread.PYTHON3 ref: 04686517
                                          • ?readLineData@QIODevice@@MAE_JPAD_J@Z.QT5CORE(00000000,?,?), ref: 04686530
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 04686544
                                          • PyBytes_FromStringAndSize.PYTHON3(00000000,00000000), ref: 04686584
                                          Strings
                                          • QProcess, xrefs: 046865B4
                                          • readLineData, xrefs: 046865AF
                                          • maximum length of data to be read cannot be negative, xrefs: 046864F2
                                          • readLineData(self, maxlen: int) -> bytes, xrefs: 046865AA
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_StringThread$?readBytes_Data@Device@@Err_FromLineRestoreSaveSize
                                          • String ID: QProcess$maximum length of data to be read cannot be negative$readLineData$readLineData(self, maxlen: int) -> bytes
                                          • API String ID: 468391905-1518086111
                                          • Opcode ID: d44eb11496220210e3921859cdcda635e9c5f5d907f308aa2f90ee5a1396ab60
                                          • Instruction ID: 6316822ac6bea3826a7a87108f9eb0f5fe47938cbd7eb1a6b6494d8be8f7bcfe
                                          • Opcode Fuzzy Hash: d44eb11496220210e3921859cdcda635e9c5f5d907f308aa2f90ee5a1396ab60
                                          • Instruction Fuzzy Hash: 4C4191B16403019FD700EB68ED45A9A37E9EB94225F484928FD19C7320F77AFD158BA2
                                          Function 046F4560 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 125threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyErr_SetString.PYTHON3(6C969C54,maximum length of data to be read cannot be negative), ref: 046F45E9
                                          • PyEval_SaveThread.PYTHON3 ref: 046F4607
                                          • ?readLineData@QFileDevice@@MAE_JPAD_J@Z.QT5CORE(00000000,?,?), ref: 046F4620
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046F4634
                                          • PyBytes_FromStringAndSize.PYTHON3(00000000,00000000), ref: 046F4674
                                          Strings
                                          • QFile, xrefs: 046F46A4
                                          • readLineData, xrefs: 046F469F
                                          • maximum length of data to be read cannot be negative, xrefs: 046F45E2
                                          • readLineData(self, maxlen: int) -> bytes, xrefs: 046F469A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_StringThread$?readBytes_Data@Device@@Err_FileFromLineRestoreSaveSize
                                          • String ID: QFile$maximum length of data to be read cannot be negative$readLineData$readLineData(self, maxlen: int) -> bytes
                                          • API String ID: 3117556883-1737716026
                                          • Opcode ID: b9a3cefd140abd342cdf1ef97c8e1d862aabed779a6f71e3c5c3343e67c2194f
                                          • Instruction ID: 77bccdb1b2700bc278582a82f2e243c490c35b5d4125f65963592093443020b1
                                          • Opcode Fuzzy Hash: b9a3cefd140abd342cdf1ef97c8e1d862aabed779a6f71e3c5c3343e67c2194f
                                          • Instruction Fuzzy Hash: 6141B3752042019FD700EB58EC45A9737E9EB94265F444834FE58C7310FB79FE198B62
                                          Function 046FA5A0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 119COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z.QT5CORE(?), ref: 046FA627
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046FA654
                                          • ?setPermissions@QFile@@SA_NABVQString@@V?$QFlags@W4Permission@QFileDevice@@@@@Z.QT5CORE(?,?), ref: 046FA6BE
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046FA6FB
                                          Strings
                                          • setPermissions(self, permissionSpec: Union[QFileDevice.Permissions, QFileDevice.Permission]) -> boolsetPermissions(filename: Optional[str], permissionSpec: Union[QFileDevice.Permissions, QFileDevice.Permission]) -> bool, xrefs: 046FA70E
                                          • QFile, xrefs: 046FA718
                                          • BJ1, xrefs: 046FA5F7
                                          • J1J1, xrefs: 046FA696
                                          • setPermissions, xrefs: 046FA713
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setBool_Device@@@@@FileFile@@Flags@FromLongPermission@Permissions@$String@@
                                          • String ID: BJ1$J1J1$QFile$setPermissions$setPermissions(self, permissionSpec: Union[QFileDevice.Permissions, QFileDevice.Permission]) -> boolsetPermissions(filename: Optional[str], permissionSpec: Union[QFileDevice.Permissions, QFileDevice.Permission]) -> bool
                                          • API String ID: 3568112042-22990399
                                          • Opcode ID: 42b888a8973957bdf26dd9b27b018c64862721b745d9305496e12270b860581f
                                          • Instruction ID: caffd66f09407c3f4dcfed832ac60501eccb010cfa9eaea2994b7ebe89e1c626
                                          • Opcode Fuzzy Hash: 42b888a8973957bdf26dd9b27b018c64862721b745d9305496e12270b860581f
                                          • Instruction Fuzzy Hash: CB413CB5248202AFC701DF94DC80E9A77E9FB88310F444859F996C7221E779EE19DB22
                                          Function 04678740 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tryLockForRead@QReadWriteLock@@QAE_NXZ.QT5CORE ref: 04678783
                                          • PyBool_FromLong.PYTHON3(?), ref: 0467878D
                                          • PyEval_SaveThread.PYTHON3 ref: 046787D0
                                          • ?tryLockForRead@QReadWriteLock@@QAE_NH@Z.QT5CORE(?), ref: 046787E0
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046787E9
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046787F3
                                          Strings
                                          • QReadWriteLock, xrefs: 04678811
                                          • tryLockForRead(self) -> booltryLockForRead(self, timeout: int) -> bool, xrefs: 04678807
                                          • tryLockForRead, xrefs: 0467880C
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?tryBool_Eval_FromLockLock@@LongReadRead@ThreadWrite$RestoreSave
                                          • String ID: QReadWriteLock$tryLockForRead$tryLockForRead(self) -> booltryLockForRead(self, timeout: int) -> bool
                                          • API String ID: 1747657020-1503846919
                                          • Opcode ID: bd0735f537caf30e7498e8cce9dac81137d258c1b72ddc39fb7b961f2a84f6b2
                                          • Instruction ID: 659474a5016f5c40dcdc4229795c40921d585a4a881409ee47107e9e9a93f472
                                          • Opcode Fuzzy Hash: bd0735f537caf30e7498e8cce9dac81137d258c1b72ddc39fb7b961f2a84f6b2
                                          • Instruction Fuzzy Hash: A2214CB5544301AFD600EB58EC49DEB7BECFB84210F484865F959D7211E778EA18CBA2
                                          Function 004086F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                          • WideCharToMultiByte.KERNEL32 ref: 00408787
                                          • GetLastError.KERNEL32(?,00402FD9), ref: 004087D0
                                          Strings
                                          • Failed to encode wchar_t as UTF-8., xrefs: 004087E0
                                          • FormatMessageW, xrefs: 004087B0
                                          • No error messages generated., xrefs: 004087A8
                                          • PyInstaller: FormatMessageW failed., xrefs: 004087C2
                                          • PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 004087FA
                                          • WideCharToMultiByte, xrefs: 004087E8
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharErrorFormatLastMessageMultiWide
                                          • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                          • API String ID: 1653872744-2573406579
                                          • Opcode ID: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                          • Instruction ID: e5d7e6b934a0c345d3486c1070e2a035779d45014a63eb974780677ace9c2cb0
                                          • Opcode Fuzzy Hash: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                          • Instruction Fuzzy Hash: 8B111AB45093018BE310AF69D54835BBAF0EB94389F50892EE4D49A285D7BD858C8BA7
                                          Function 00407FD0 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004046B0: _wfopen.MSVCRT ref: 00404703
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                            • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                            • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                            • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                            • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                          • feof.MSVCRT ref: 00408033
                                          • fread.MSVCRT ref: 00408057
                                          • ferror.MSVCRT ref: 00408063
                                          • clearerr.MSVCRT ref: 00408074
                                          • fwrite.MSVCRT ref: 00408093
                                          • ferror.MSVCRT ref: 0040809F
                                          • clearerr.MSVCRT ref: 004080B0
                                          • fclose.MSVCRT ref: 004080B8
                                          • fclose.MSVCRT ref: 004080C0
                                          • fclose.MSVCRT ref: 004080E3
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclosestrlen$clearerrferrorstrtok$_wfopen_wstatfeoffreadfwritestrcpy
                                          • String ID:
                                          • API String ID: 3104166669-0
                                          • Opcode ID: 8e6a509980fd6fa00181d3b83e4a0fbf1b4b6af25df58c2b9d8ba5ed948ad107
                                          • Instruction ID: e6213c5d7688b8fe1ba8341ac8fdb9db29b335e178dc78efa11f235658ae9a09
                                          • Opcode Fuzzy Hash: 8e6a509980fd6fa00181d3b83e4a0fbf1b4b6af25df58c2b9d8ba5ed948ad107
                                          • Instruction Fuzzy Hash: 6C2110716087518AD7107F2696812AFB6E4AF84354F07493FE8D4A73C1DB7DC889CB8A
                                          Function 00411E60 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: %*.*s$%-*.*s$%.*s
                                          • API String ID: 0-4054516066
                                          • Opcode ID: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                          • Instruction ID: 34a7cfded508d75713a3901c6ba7bdf4e42489cc40e2d4f26330675e440d4311
                                          • Opcode Fuzzy Hash: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                          • Instruction Fuzzy Hash: D74140B16047018BDB148F28C5C5696B7E1BF84354F25866EEE898F36AD339D8C2CB49
                                          Function 046FA420 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?fromTime_t@QDateTime@@SA?AV1@I@Z.QT5CORE(00000000,?,00000004), ref: 046FA46A
                                          • ?fromTime_t@QDateTime@@SA?AV1@IW4TimeSpec@Qt@@H@Z.QT5CORE(00000000,?,?,?,00000004), ref: 046FA4E4
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          • fromTime_t, xrefs: 046FA576
                                          • uJ9, xrefs: 046FA516
                                          • QDateTime, xrefs: 046FA57B
                                          • uE|i, xrefs: 046FA4A9
                                          • fromTime_t(secsSince1Jan1970UTC: int) -> QDateTimefromTime_t(secsSince1Jan1970UTC: int, spec: Qt.TimeSpec, offsetSeconds: int = 0) -> QDateTimefromTime_t(secsSince1Jan1970UTC: int, timeZone: QTimeZone) -> QDateTime, xrefs: 046FA571
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?fromDateTime@@Time_t@$Qt@@Spec@Timemalloc
                                          • String ID: QDateTime$fromTime_t$fromTime_t(secsSince1Jan1970UTC: int) -> QDateTimefromTime_t(secsSince1Jan1970UTC: int, spec: Qt.TimeSpec, offsetSeconds: int = 0) -> QDateTimefromTime_t(secsSince1Jan1970UTC: int, timeZone: QTimeZone) -> QDateTime$uE|i$uJ9
                                          • API String ID: 989538957-1568739613
                                          • Opcode ID: 67eb0dc375ad8633fb4e56c9ebd780d32bd6de57e43497c5e7af914feeae4b14
                                          • Instruction ID: b0dd0b25c4bd2304c34b3a8a3131adecafdb05190c11d08e8ccdcb553e2cc906
                                          • Opcode Fuzzy Hash: 67eb0dc375ad8633fb4e56c9ebd780d32bd6de57e43497c5e7af914feeae4b14
                                          • Instruction Fuzzy Hash: C441AEB1244201AFD710EB98EC45FDB77ECFB88710F444818FA68D7261D2B9EA558B62
                                          Function 047106E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?mapSelectionToSource@QIdentityProxyModel@@UBE?AVQItemSelection@@ABV2@@Z.QT5CORE(?,?), ref: 0471076A
                                          • ??0QItemSelection@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 04710773
                                          • ??0QItemSelection@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 0471078F
                                          • ??1?$QList@VQItemSelectionRange@@@@QAE@XZ.QT5CORE ref: 0471079B
                                          Strings
                                          • BJ9, xrefs: 0471072A
                                          • QIdentityProxyModel, xrefs: 047107CC
                                          • mapSelectionToSource, xrefs: 047107C7
                                          • mapSelectionToSource(self, selection: QItemSelection) -> QItemSelection, xrefs: 047107C2
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Item$Selection@@$E@$$SelectionV0@@$??1?$?mapIdentityList@Model@@ProxyRange@@@@Source@V2@@
                                          • String ID: BJ9$QIdentityProxyModel$mapSelectionToSource$mapSelectionToSource(self, selection: QItemSelection) -> QItemSelection
                                          • API String ID: 681040075-725092228
                                          • Opcode ID: 4ac68722f25632b1e4f7b552d9d25de5e22bc20a7b1c1f37a8d5cae187bead94
                                          • Instruction ID: 738b1e84b27780064b0e20f8471414d9bd4c06a58faa18782bd8babdaa48f3f2
                                          • Opcode Fuzzy Hash: 4ac68722f25632b1e4f7b552d9d25de5e22bc20a7b1c1f37a8d5cae187bead94
                                          • Instruction Fuzzy Hash: C4216FB0244302AFDB00DBA8DC84EEA77E9FB44250F084468F915C7321E679ED49DB52
                                          Function 046826F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QByteArray@@QAE@XZ.QT5CORE ref: 04682707
                                          • ?writeNamespace@QXmlStreamWriter@@QAEXABVQString@@0@Z.QT5CORE(?,?), ref: 04682781
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 046827D6
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 046827E7
                                          Strings
                                          • writeNamespace(self, namespaceUri: Optional[str], prefix: Optional[str] = ''), xrefs: 046827F2
                                          • QXmlStreamWriter, xrefs: 046827FC
                                          • writeNamespace, xrefs: 046827F7
                                          • BJ1|J1, xrefs: 04682747
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?writeArray@@ByteNamespace@StreamString@@0@Writer@@
                                          • String ID: BJ1|J1$QXmlStreamWriter$writeNamespace$writeNamespace(self, namespaceUri: Optional[str], prefix: Optional[str] = '')
                                          • API String ID: 3062303027-3110615713
                                          • Opcode ID: a3fb9e574366ece8b914368e8b2cc45a3159305e8305f0f638137a824ed76a35
                                          • Instruction ID: b4f425ff54054dabb552e9a447586896db2f29ecf6aabbe2c4415607ed24dfaa
                                          • Opcode Fuzzy Hash: a3fb9e574366ece8b914368e8b2cc45a3159305e8305f0f638137a824ed76a35
                                          • Instruction Fuzzy Hash: 46313671108341AFCB01DF84D844EAABBF9FB88304F44895DF99587260E7B5AE19DF52
                                          Function 047086F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 72timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QTime@@QBE_NXZ.QT5CORE ref: 04708738
                                          • PyBool_FromLong.PYTHON3(?), ref: 04708742
                                          • ?isValid@QTime@@SA_NHHHH@Z.QT5CORE(?,?,?,?), ref: 047087A8
                                          • PyBool_FromLong.PYTHON3(?), ref: 047087B2
                                          Strings
                                          • QTime, xrefs: 047087CE
                                          • isValid(self) -> boolisValid(h: int, m: int, s: int, msec: int = 0) -> bool, xrefs: 047087C4
                                          • iii|i, xrefs: 0470876B
                                          • isValid, xrefs: 047087C9
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLongTime@@Valid@
                                          • String ID: QTime$iii|i$isValid$isValid(self) -> boolisValid(h: int, m: int, s: int, msec: int = 0) -> bool
                                          • API String ID: 3461666488-1940554083
                                          • Opcode ID: b50a07d4fcd5a4b024c243cab154aa126df51d08ba6d3518d9d9682b03877faa
                                          • Instruction ID: de97ccab3e1e644af9dc02ea8a52348f19299029c0318b291bd2a3560fc7220d
                                          • Opcode Fuzzy Hash: b50a07d4fcd5a4b024c243cab154aa126df51d08ba6d3518d9d9682b03877faa
                                          • Instruction Fuzzy Hash: B4217CB1148301BFC701EF94DC41F9B77E8FB88700F458869F99992261D779EA249B12
                                          Function 00408810 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00408CF4), ref: 0040885C
                                          • calloc.MSVCRT ref: 00408875
                                          • WideCharToMultiByte.KERNEL32 ref: 004088B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                          • API String ID: 1374691127-3831141058
                                          • Opcode ID: c3fa3e70c31a3458ec14f411ced81c1205de6429d75ae9f1c074563e70b42a84
                                          • Instruction ID: 5afcbffd29298bee6e331de86764b825c866944575c44242363fe351b07975aa
                                          • Opcode Fuzzy Hash: c3fa3e70c31a3458ec14f411ced81c1205de6429d75ae9f1c074563e70b42a84
                                          • Instruction Fuzzy Hash: 8521F5B15093059FD310AF66D64835BBBE4EB90358F00892EE4D85B281DBB984889BDB
                                          Function 00408920 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                          • calloc.MSVCRT ref: 004089EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                          • API String ID: 1374691127-27947307
                                          • Opcode ID: 2b09dc83ad61f560e2c3f0a7be34deb6504115085fa0c16350d3644281db57d5
                                          • Instruction ID: 392d32d0dc93c970adbdd4bd206061dd84090e66cdb548403919dc1ed5805d2f
                                          • Opcode Fuzzy Hash: 2b09dc83ad61f560e2c3f0a7be34deb6504115085fa0c16350d3644281db57d5
                                          • Instruction Fuzzy Hash: B021E7B01093028BD310AF66D55831BBAE4EF94758F00892EE4E4572D0D7B9D989DB97
                                          Function 00408374 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • LOADER: failed to allocate argv_pyi: %s, xrefs: 0040842D
                                          • LOADER: failed to strdup argv[%d]: %s, xrefs: 0040840A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _errnostrerror$_strdupcalloc
                                          • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                          • API String ID: 4278403329-2782260415
                                          • Opcode ID: 888027ff366d88e196ffac7e22f8e9512d8f32fb5de0ea3c8c6ec2f618f8796d
                                          • Instruction ID: 75a4103835d43aa6c95cb7ec3b6db505b02a0d5b0f758bc2d410c1ae15a23f9c
                                          • Opcode Fuzzy Hash: 888027ff366d88e196ffac7e22f8e9512d8f32fb5de0ea3c8c6ec2f618f8796d
                                          • Instruction Fuzzy Hash: 0A2179B4904711CFC720AF75D94419ABBE0EB45314F514A7EE894A33A1E739E881CB9A
                                          Function 004014F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 43libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$HandleLibraryLoadModule
                                          • String ID: , B$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                          • API String ID: 384173800-2541462354
                                          • Opcode ID: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                          • Instruction ID: 6c6c026f4a83c0f72c7764c329cd2c4586c53e905c616f5fc2452e48b3062107
                                          • Opcode Fuzzy Hash: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                          • Instruction Fuzzy Hash: 200175B1805304ABD700BF79AD4425ABFF4EB44399F02853FE98957260D7789848CB9F
                                          Function 004055C3 Relevance: 13.5, APIs: 9, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: setbuf$_fileno_setmodefflush
                                          • String ID:
                                          • API String ID: 1650367497-0
                                          • Opcode ID: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                          • Instruction ID: 4513b405083115c81ca635af3cf8f4969db3efee2aa6dccd88a9e4f4ed2810d7
                                          • Opcode Fuzzy Hash: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                          • Instruction Fuzzy Hash: CB1120B15097108BD7007FB5D59936EBBE0BF45314F83481DD4C897241EBBD94848B9A
                                          Function 046BC6F0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?qEnvironmentVariable@@YA?AVQString@@PBD@Z.QT5CORE(00000000,?,00000004), ref: 046BC735
                                          • _Py_Dealloc.PYTHON3(?), ref: 046BC756
                                          • ?qEnvironmentVariable@@YA?AVQString@@PBDABV1@@Z.QT5CORE(00000000,?,?,00000004), ref: 046BC7CB
                                          • _Py_Dealloc.PYTHON3(?), ref: 046BC7EC
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          • qEnvironmentVariable, xrefs: 046BC832
                                          • qEnvironmentVariable(varName: Optional[str]) -> strqEnvironmentVariable(varName: Optional[str], defaultValue: Optional[str]) -> str, xrefs: 046BC82D
                                          • AAJ1, xrefs: 046BC79C
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DeallocEnvironmentString@@Variable@@$V1@@malloc
                                          • String ID: AAJ1$qEnvironmentVariable$qEnvironmentVariable(varName: Optional[str]) -> strqEnvironmentVariable(varName: Optional[str], defaultValue: Optional[str]) -> str
                                          • API String ID: 1499958568-752762865
                                          • Opcode ID: 46a70f602cc3c3a4f8fb826560f47417207424a14aab0aaec30159700ea84a82
                                          • Instruction ID: 3b009f965b358d91b5a9d9f8bc0137dd14a44791a489fe64310f2f94b1c0ea4a
                                          • Opcode Fuzzy Hash: 46a70f602cc3c3a4f8fb826560f47417207424a14aab0aaec30159700ea84a82
                                          • Instruction Fuzzy Hash: FF418FB1104201AFD710DF58DC84EDA77E9FF88324F048968FA6997360E775EA548BA2
                                          Function 0469E540 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?captured@QRegularExpressionMatch@@QBE?AVQString@@H@Z.QT5CORE(00000000,?), ref: 0469E5AA
                                          • ?captured@QRegularExpressionMatch@@QBE?AVQString@@ABV2@@Z.QT5CORE(00000000,?), ref: 0469E62D
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?captured@ExpressionMatch@@RegularString@@$V2@@malloc
                                          • String ID: BJ1$B|i$QRegularExpressionMatch$captured$captured(self, nth: int = 0) -> strcaptured(self, name: Optional[str]) -> str
                                          • API String ID: 1688244335-910343657
                                          • Opcode ID: b43028e246619393262a3366af32cd16140e0a85db9c2bbcb91455d0d8604618
                                          • Instruction ID: 3ed7eaae22e329f5b6ed4dca228b84d15477d908d456254c3001d9949e59af82
                                          • Opcode Fuzzy Hash: b43028e246619393262a3366af32cd16140e0a85db9c2bbcb91455d0d8604618
                                          • Instruction Fuzzy Hash: 2A318DB5244302BFDB10DB94DC41FEA77E9FB88314F044858FA5897260E7B9ED148B62
                                          Function 046D6590 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setFileNameAndVersion@QLibrary@@QAEXABVQString@@H@Z.QT5CORE(?,?), ref: 046D65F5
                                          • ?setFileNameAndVersion@QLibrary@@QAEXABVQString@@0@Z.QT5CORE(?,?), ref: 046D6684
                                          Strings
                                          • BJ1i, xrefs: 046D65C7
                                          • setFileNameAndVersion(self, fileName: Optional[str], verNum: int)setFileNameAndVersion(self, fileName: Optional[str], version: Optional[str]), xrefs: 046D66DD
                                          • BJ1J1, xrefs: 046D6656
                                          • QLibrary, xrefs: 046D66E7
                                          • setFileNameAndVersion, xrefs: 046D66E2
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setFileLibrary@@NameVersion@$String@@String@@0@
                                          • String ID: BJ1J1$BJ1i$QLibrary$setFileNameAndVersion$setFileNameAndVersion(self, fileName: Optional[str], verNum: int)setFileNameAndVersion(self, fileName: Optional[str], version: Optional[str])
                                          • API String ID: 1411382494-1313783473
                                          • Opcode ID: 3adede91b4f34bdfb4a994726b4275293e6b5bc0ef39c86a40d7988ea3c4267c
                                          • Instruction ID: 6c3c6b7d98a743693ce80e4cec7ce0fae77943254ddd4de50ea8f0ab93b61063
                                          • Opcode Fuzzy Hash: 3adede91b4f34bdfb4a994726b4275293e6b5bc0ef39c86a40d7988ea3c4267c
                                          • Instruction Fuzzy Hash: E54108B5108302AFD701DF54DC40E9A7BF9FB88314F448959F9A583220E375E969DF62
                                          Function 046C4540 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?select@QFileSelector@@QBE?AVQString@@ABV2@@Z.QT5CORE(00000000,?), ref: 046C45AA
                                          • ?select@QFileSelector@@QBE?AVQUrl@@ABV2@@Z.QT5CORE(00000000,?), ref: 046C4633
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?select@FileSelector@@V2@@$String@@Url@@malloc
                                          • String ID: BJ1$BJ9$QFileSelector$select$select(self, filePath: Optional[str]) -> strselect(self, filePath: QUrl) -> QUrl
                                          • API String ID: 2905325449-1516460048
                                          • Opcode ID: 275237655d07773e0740a0f542bbe925998e525dea316c2452d0b71d95e4915f
                                          • Instruction ID: a8dc9454c8dcc0e902ee44035a99bfe9800b68a9e35fe24e1d9b69802592fb0d
                                          • Opcode Fuzzy Hash: 275237655d07773e0740a0f542bbe925998e525dea316c2452d0b71d95e4915f
                                          • Instruction Fuzzy Hash: 00317EB1104202AFD700DF54DC40EEA77E9FB88314F444858FA6997220E779ED15CB62
                                          Function 046505E0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?removeRows@QStringListModel@@UAE_NHHABVQModelIndex@@@Z.QT5CORE(?,?,?), ref: 0465069D
                                          • PyBool_FromLong.PYTHON3(?), ref: 046506A7
                                          • PyBool_FromLong.PYTHON3(?), ref: 046506C0
                                          Strings
                                          • removeRows, xrefs: 046506D8
                                          • Bii|J9, xrefs: 0465065C
                                          • removeRows(self, row: int, count: int, parent: QModelIndex = QModelIndex()) -> bool, xrefs: 046506D3
                                          • QStringListModel, xrefs: 046506DD
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?removeIndex@@@ListModelModel@@Rows@String
                                          • String ID: Bii|J9$QStringListModel$removeRows$removeRows(self, row: int, count: int, parent: QModelIndex = QModelIndex()) -> bool
                                          • API String ID: 1619176562-3482229692
                                          • Opcode ID: 08d4adb393013693db7bae563e4c1af8e10b978a764880ae11aa0f336d57881e
                                          • Instruction ID: 120d69f7c8ab7c9e073912b78cd34c69bbe77bb595beda686be91079b16b1522
                                          • Opcode Fuzzy Hash: 08d4adb393013693db7bae563e4c1af8e10b978a764880ae11aa0f336d57881e
                                          • Instruction Fuzzy Hash: 1E316DB4248301AFC710CF54DC85EAA77E8FB88310F044929F8A997261E379EA589B52
                                          Function 046F4750 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?insertColumns@QAbstractItemModel@@UAE_NHHABVQModelIndex@@@Z.QT5CORE(?,?,?), ref: 046F480D
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F4817
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F4830
                                          Strings
                                          • insertRows, xrefs: 046F4848
                                          • Bii|J9, xrefs: 046F47CC
                                          • QAbstractItemModel, xrefs: 046F484D
                                          • insertRows(self, row: int, count: int, parent: QModelIndex = QModelIndex()) -> bool, xrefs: 046F4843
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?insertAbstractColumns@Index@@@ItemModelModel@@
                                          • String ID: Bii|J9$QAbstractItemModel$insertRows$insertRows(self, row: int, count: int, parent: QModelIndex = QModelIndex()) -> bool
                                          • API String ID: 1408860933-2570992489
                                          • Opcode ID: 800df3f4e1a3d6651235a39a44036dbf4c4e221a0c9ec045cc223d9190daae1c
                                          • Instruction ID: 69e4e47059f5e3b86ef2515eecabb1667bf3cacdab0f2e3b0f63b2daa196949a
                                          • Opcode Fuzzy Hash: 800df3f4e1a3d6651235a39a44036dbf4c4e221a0c9ec045cc223d9190daae1c
                                          • Instruction Fuzzy Hash: 6B318BB0148301AFC700CF64CD81EAB77E8FB98310F440929F9A9C2360E739EA589B52
                                          Function 0468E4D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 80threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0468E53E
                                          • ?writeData@QSaveFile@@MAE_JPBD_J@Z.QT5CORE(?,?), ref: 0468E55B
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 0468E56F
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 0468E577
                                          Strings
                                          • writeData, xrefs: 0468E592
                                          • QSaveFile, xrefs: 0468E597
                                          • writeData(self, data: Optional[PyQt5.sip.array[bytes]]) -> int, xrefs: 0468E58D
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_LongSaveThread$?writeData@File@@FromLong_Restore
                                          • String ID: QSaveFile$writeData$writeData(self, data: Optional[PyQt5.sip.array[bytes]]) -> int
                                          • API String ID: 1709558933-3146772046
                                          • Opcode ID: 7f1c2ed4c3a159976a1591db86aaa7f34ee7056c8a4d73f00b011803012bfe63
                                          • Instruction ID: f36386ff641845c679d9125e27753d96d80ef1b5711cc9078a247aa06b6b834e
                                          • Opcode Fuzzy Hash: 7f1c2ed4c3a159976a1591db86aaa7f34ee7056c8a4d73f00b011803012bfe63
                                          • Instruction Fuzzy Hash: 04217171244301AFD710EB68DC44DAB77ECEB88620F444968F918C7321F67AED098B62
                                          Function 047005A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?fileName@QFileDevice@@UBE?AVQString@@XZ.QT5CORE(?), ref: 0470061B
                                          • ??0QString@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 04700624
                                          • ??0QString@@QAE@$$QAV0@@Z.QT5CORE(00000000), ref: 0470063D
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 04700649
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$E@$$V0@@$?fileDevice@@FileName@
                                          • String ID: QFileDevice$fileName$fileName(self) -> str
                                          • API String ID: 968684854-494034459
                                          • Opcode ID: 9ae4628198fb57cba5c198ea6c1588c46369c5ac53f500cde7b10eca792a7cae
                                          • Instruction ID: 38e2f0dd214e28ff22d800e93cba368cf9d4ce1ca26c192d45d3c5e41351e0ff
                                          • Opcode Fuzzy Hash: 9ae4628198fb57cba5c198ea6c1588c46369c5ac53f500cde7b10eca792a7cae
                                          • Instruction Fuzzy Hash: AC216DB1245202DFD700DBA4EC45EAA33E9EB88210F448868F955E7350E779FD09DB62
                                          Function 046F0400 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?hasChildren@QAbstractItemModel@@UBE_NABVQModelIndex@@@Z.QT5CORE(?), ref: 046F04AB
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F04B5
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F04CE
                                          Strings
                                          • hasChildren(self, parent: QModelIndex = QModelIndex()) -> bool, xrefs: 046F04E1
                                          • hasChildren, xrefs: 046F04E6
                                          • QAbstractItemModel, xrefs: 046F04EB
                                          • B|J9, xrefs: 046F046A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?hasAbstractChildren@Index@@@ItemModelModel@@
                                          • String ID: B|J9$QAbstractItemModel$hasChildren$hasChildren(self, parent: QModelIndex = QModelIndex()) -> bool
                                          • API String ID: 3675483984-197315385
                                          • Opcode ID: 9ef0c253830165cc2c8d593c284ca3b4e69038b03e026940c4c64d740237588b
                                          • Instruction ID: 8e29c54ec6842cb2f1cf5dc7712d77daddc80f345878a8bec21c1757488aa021
                                          • Opcode Fuzzy Hash: 9ef0c253830165cc2c8d593c284ca3b4e69038b03e026940c4c64d740237588b
                                          • Instruction Fuzzy Hash: D9216DB0244302AFD710DF54DC45FAA77E8FB84310F444968F998C7352E379EA199B62
                                          Function 047066B0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?columnCount@QConcatenateTablesProxyModel@@UBEHABVQModelIndex@@@Z.QT5CORE(?), ref: 0470675B
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04706762
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04706776
                                          Strings
                                          • columnCount(self, parent: QModelIndex = QModelIndex()) -> int, xrefs: 04706789
                                          • columnCount, xrefs: 0470678E
                                          • QConcatenateTablesProxyModel, xrefs: 04706793
                                          • B|J9, xrefs: 0470671A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_$?columnConcatenateCount@Index@@@ModelModel@@ProxyTables
                                          • String ID: B|J9$QConcatenateTablesProxyModel$columnCount$columnCount(self, parent: QModelIndex = QModelIndex()) -> int
                                          • API String ID: 697187893-55648497
                                          • Opcode ID: 7d78edd1c9aa5e06716f6bd85d6395307bcffb8f92e80d969969665738c008ec
                                          • Instruction ID: 63605ff4f059b77cdc8bfb87e183bb0a37f80bbf2bbf0ac277e172797d89e8a8
                                          • Opcode Fuzzy Hash: 7d78edd1c9aa5e06716f6bd85d6395307bcffb8f92e80d969969665738c008ec
                                          • Instruction Fuzzy Hash: C6217FB4544301AFC710DF64DC45F9A7BE8FB44310F488968F8A5C7350D379EA289B52
                                          Function 046726A0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 73threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0467270E
                                          • ?setValue@QSettings@@QAEXABVQString@@ABVQVariant@@@Z.QT5CORE(?,?), ref: 04672722
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 04672729
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?setRestoreSaveSettings@@String@@Value@Variant@@@
                                          • String ID: BJ1J1$QSettings$setValue$setValue(self, key: Optional[str], value: Any)
                                          • API String ID: 1500147538-3203008001
                                          • Opcode ID: 83ae092261b360ea641f40cf4792fac0b8e296980a523f514cc41b5d095fdd81
                                          • Instruction ID: 974940b6235442f374a8fad5fea708b99de9f8bd2e29ea437032a3b836f80a25
                                          • Opcode Fuzzy Hash: 83ae092261b360ea641f40cf4792fac0b8e296980a523f514cc41b5d095fdd81
                                          • Instruction Fuzzy Hash: BB210875104301AFD701DF54DC44E9A7BF9FB88314F448969F964C7220E379AA159F52
                                          Function 046C6730 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 73COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z.QT5CORE(?,?), ref: 046C67B2
                                          • PyBool_FromLong.PYTHON3(?), ref: 046C67BC
                                          • PyBool_FromLong.PYTHON3(?), ref: 046C67D5
                                          Strings
                                          • BJ8J8, xrefs: 046C6780
                                          • eventFilter, xrefs: 046C67ED
                                          • QObject, xrefs: 046C67F2
                                          • eventFilter(self, a0: Optional[QObject], a1: Optional[QEvent]) -> bool, xrefs: 046C67E8
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?eventEvent@@@Filter@Object@@
                                          • String ID: BJ8J8$QObject$eventFilter$eventFilter(self, a0: Optional[QObject], a1: Optional[QEvent]) -> bool
                                          • API String ID: 3229412136-3809525846
                                          • Opcode ID: 192e5d4f6300a2596142f705de8966ede3b8be235f69a98ed132918ac2dd2b59
                                          • Instruction ID: 5b0d1a41f4de88144da020f529bc25f11462f0ca9dcbe311baa68b92d80695b2
                                          • Opcode Fuzzy Hash: 192e5d4f6300a2596142f705de8966ede3b8be235f69a98ed132918ac2dd2b59
                                          • Instruction Fuzzy Hash: 502154B1284202AFD740EF54DD45EBA37E8FB54210F444858F855C7311E779F919DB62
                                          Function 04666550 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?eventFilter@QStateMachine@@UAE_NPAVQObject@@PAVQEvent@@@Z.QT5CORE(?,?), ref: 046665D7
                                          • PyBool_FromLong.PYTHON3(?), ref: 046665E1
                                          • PyBool_FromLong.PYTHON3(?), ref: 046665FA
                                          Strings
                                          • eventFilter(self, watched: Optional[QObject], event: Optional[QEvent]) -> bool, xrefs: 0466660D
                                          • BJ8J8, xrefs: 046665A5
                                          • eventFilter, xrefs: 04666612
                                          • QStateMachine, xrefs: 04666617
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?eventEvent@@@Filter@Machine@@Object@@State
                                          • String ID: BJ8J8$QStateMachine$eventFilter$eventFilter(self, watched: Optional[QObject], event: Optional[QEvent]) -> bool
                                          • API String ID: 506968866-1673174555
                                          • Opcode ID: 447c1b748d045c6b98bb0d67c0ca91a2792494bceeb5182bf41be108c7f6ab94
                                          • Instruction ID: d1f5f542558d4e8da1ec717e63044cb6baa8aeb388638ee09560c650de7aaa9b
                                          • Opcode Fuzzy Hash: 447c1b748d045c6b98bb0d67c0ca91a2792494bceeb5182bf41be108c7f6ab94
                                          • Instruction Fuzzy Hash: FD214270644202AFDB40DF64ED45DAA37E9FB94210F844864F869C7321E279FE199B62
                                          Function 04692410 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?filterAcceptsColumn@QSortFilterProxyModel@@MBE_NHABVQModelIndex@@@Z.QT5CORE(?,?), ref: 04692491
                                          • PyBool_FromLong.PYTHON3(?), ref: 0469249B
                                          • PyBool_FromLong.PYTHON3(?), ref: 046924B7
                                          Strings
                                          • filterAcceptsColumn(self, source_column: int, source_parent: QModelIndex) -> bool, xrefs: 046924CA
                                          • QSortFilterProxyModel, xrefs: 046924D4
                                          • BiJ9, xrefs: 0469245F
                                          • filterAcceptsColumn, xrefs: 046924CF
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?filterAcceptsColumn@FilterIndex@@@ModelModel@@ProxySort
                                          • String ID: BiJ9$QSortFilterProxyModel$filterAcceptsColumn$filterAcceptsColumn(self, source_column: int, source_parent: QModelIndex) -> bool
                                          • API String ID: 2269181232-3775990416
                                          • Opcode ID: 8c5eb707260b53cb10ce73579f0223ce41c53c02a6df5fb610e36c07a312cd42
                                          • Instruction ID: 540d6276fb48e8c9a9ba40ada0595f0fbe481aa08907fb6c66cb29be0217abb6
                                          • Opcode Fuzzy Hash: 8c5eb707260b53cb10ce73579f0223ce41c53c02a6df5fb610e36c07a312cd42
                                          • Instruction Fuzzy Hash: 32218174244301AFDB00EF64DD45DAA37ECFB88710F8848A4F859C7321E279E9199F22
                                          Function 046BC510 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71threadwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04755530: PyImport_ImportModule.PYTHON3(inspect), ref: 04755554
                                            • Part of subcall function 04755530: PyObject_GetAttrString.PYTHON3(00000000,currentframe), ref: 04755578
                                            • Part of subcall function 04755530: PyObject_GetAttrString.PYTHON3(00000000,getframeinfo), ref: 04755591
                                            • Part of subcall function 04755530: _Py_Dealloc.PYTHON3(00000000), ref: 047555AC
                                            • Part of subcall function 04755530: PyObject_CallFunctionObjArgs.PYTHON3(00000000), ref: 047555D9
                                            • Part of subcall function 04755530: PyObject_CallFunctionObjArgs.PYTHON3(00000000,00000000), ref: 047555F1
                                            • Part of subcall function 04755530: PyTuple_GetItem.PYTHON3(00000000,00000000), ref: 04755609
                                            • Part of subcall function 04755530: PyTuple_GetItem.PYTHON3(00000000,00000001), ref: 0475561D
                                            • Part of subcall function 04755530: PyTuple_GetItem.PYTHON3(00000000,00000002), ref: 04755631
                                            • Part of subcall function 04755530: _Py_Dealloc.PYTHON3(00000000), ref: 0475565B
                                            • Part of subcall function 04755530: PyUnicode_AsEncodedString.PYTHON3(?,latin_1,ignore), ref: 0475566E
                                          • PyEval_SaveThread.PYTHON3 ref: 046BC560
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(?,00000000,?,04786710,?), ref: 046BC57E
                                          • ?critical@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000), ref: 046BC585
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046BC58C
                                          • _Py_Dealloc.PYTHON3(?), ref: 046BC5AC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object_$DeallocItemStringTuple_$ArgsAttrCallEval_FunctionLogger@@MessageThread$?critical@EncodedImportImport_ModuleRestoreSaveUnicode_
                                          • String ID: qCritical$qCritical(msg: Optional[str])
                                          • API String ID: 555852178-2821957897
                                          • Opcode ID: fdca5d9c69dfcca23e0430e4cbecb1e977125ad5f51bfac095cd639d8962a303
                                          • Instruction ID: da9855734634ffa46e11864744976e7bc3afa6750fbfb6e6c08fe2a1243251de
                                          • Opcode Fuzzy Hash: fdca5d9c69dfcca23e0430e4cbecb1e977125ad5f51bfac095cd639d8962a303
                                          • Instruction Fuzzy Hash: 1B21AFB2100300AFC700DF64DC48C9A3BE8FB88324F444A29F959D7360E779EE568B52
                                          Function 046BC600 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71threadwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04755530: PyImport_ImportModule.PYTHON3(inspect), ref: 04755554
                                            • Part of subcall function 04755530: PyObject_GetAttrString.PYTHON3(00000000,currentframe), ref: 04755578
                                            • Part of subcall function 04755530: PyObject_GetAttrString.PYTHON3(00000000,getframeinfo), ref: 04755591
                                            • Part of subcall function 04755530: _Py_Dealloc.PYTHON3(00000000), ref: 047555AC
                                            • Part of subcall function 04755530: PyObject_CallFunctionObjArgs.PYTHON3(00000000), ref: 047555D9
                                            • Part of subcall function 04755530: PyObject_CallFunctionObjArgs.PYTHON3(00000000,00000000), ref: 047555F1
                                            • Part of subcall function 04755530: PyTuple_GetItem.PYTHON3(00000000,00000000), ref: 04755609
                                            • Part of subcall function 04755530: PyTuple_GetItem.PYTHON3(00000000,00000001), ref: 0475561D
                                            • Part of subcall function 04755530: PyTuple_GetItem.PYTHON3(00000000,00000002), ref: 04755631
                                            • Part of subcall function 04755530: _Py_Dealloc.PYTHON3(00000000), ref: 0475565B
                                            • Part of subcall function 04755530: PyUnicode_AsEncodedString.PYTHON3(?,latin_1,ignore), ref: 0475566E
                                          • PyEval_SaveThread.PYTHON3 ref: 046BC650
                                          • ??0QMessageLogger@@QAE@PBDH0@Z.QT5CORE(?,00000000,?,04786710,?), ref: 046BC66E
                                          • ?debug@QMessageLogger@@QBAXPBDZZ.QT5CORE(00000000), ref: 046BC675
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046BC67C
                                          • _Py_Dealloc.PYTHON3(?), ref: 046BC69C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Object_$DeallocItemStringTuple_$ArgsAttrCallEval_FunctionLogger@@MessageThread$?debug@EncodedImportImport_ModuleRestoreSaveUnicode_
                                          • String ID: qDebug$qDebug(msg: Optional[str])
                                          • API String ID: 1474871938-2010309102
                                          • Opcode ID: 0f197f3faa5495fb4ba32816796e88fc579f95e2a3762aee186535cee4c9c14a
                                          • Instruction ID: 63aa8fddb39f870d0c106f2fcc64e8610154cfb25afa25a4b8c7561f981e82c8
                                          • Opcode Fuzzy Hash: 0f197f3faa5495fb4ba32816796e88fc579f95e2a3762aee186535cee4c9c14a
                                          • Instruction Fuzzy Hash: C8216071204300AFC700DF64DC49DDA77E8FB88324F444929F859D7360E679AA56CB52
                                          Function 046D0420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?exists@QFileInfo@@QBE_NXZ.QT5CORE ref: 046D0460
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D046A
                                          • ?exists@QFileInfo@@SA_NABVQString@@@Z.QT5CORE(?), ref: 046D04B6
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046D04DB
                                          Strings
                                          • exists(self) -> boolexists(file: Optional[str]) -> bool, xrefs: 046D04EE
                                          • exists, xrefs: 046D04F3
                                          • QFileInfo, xrefs: 046D04F8
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?exists@Bool_FileFromInfo@@Long$String@@@
                                          • String ID: QFileInfo$exists$exists(self) -> boolexists(file: Optional[str]) -> bool
                                          • API String ID: 831652642-2772593627
                                          • Opcode ID: 89373157b29b1def9eb2b295268d9cad20bf4c300d6990eb457059c3dcac5eff
                                          • Instruction ID: 99125a4ed094ef0d48dd833e0444ece34e61b81fba4221312c21735cec623721
                                          • Opcode Fuzzy Hash: 89373157b29b1def9eb2b295268d9cad20bf4c300d6990eb457059c3dcac5eff
                                          • Instruction Fuzzy Hash: 592150B0544201EFC701EB54EC45EAA7BE9FB88314F448868F859D3221D379EE28DB62
                                          Function 0466A400 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?event@QSequentialAnimationGroup@@MAE_NPAVQEvent@@@Z.QT5CORE(?), ref: 0466A478
                                          • PyBool_FromLong.PYTHON3(?), ref: 0466A482
                                          • PyBool_FromLong.PYTHON3(?), ref: 0466A49B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?event@AnimationEvent@@@Group@@Sequential
                                          • String ID: BJ8$QParallelAnimationGroup$event$event(self, event: Optional[QEvent]) -> bool
                                          • API String ID: 1225183979-1835578713
                                          • Opcode ID: 30fffd453b224b08dd941709c147e7afcadc9ef24d870d0c072c2ccea8e539de
                                          • Instruction ID: 75571b2a166c3de6b3a22d12b72cb65b3ba2f4b803402b09cdecf21a1a5a7212
                                          • Opcode Fuzzy Hash: 30fffd453b224b08dd941709c147e7afcadc9ef24d870d0c072c2ccea8e539de
                                          • Instruction Fuzzy Hash: AB217270244301AFD600DF94EC85EAA37E9FB84214F484464FC5AD7321E239EA58EB52
                                          Function 046F86A0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?keysToValue@QMetaEnum@@QBEHPBDPA_N@Z.QT5CORE(?,?), ref: 046F8700
                                          • _Py_Dealloc.PYTHON3(?), ref: 046F871E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?keysDeallocEnum@@MetaValue@
                                          • String ID: (ib)$BAA$QMetaEnum$keysToValue$keysToValue(self, keys: Optional[str]) -> (int, Optional[bool])
                                          • API String ID: 2946910240-2914817286
                                          • Opcode ID: 2b91fa647f9f46f324db6d041e479484766e2137a484c7d31420e19634f6b2a6
                                          • Instruction ID: e3b4006b684155603ed32bc4bf5355359d1bb91ca8f1633b682d0b9b284481c4
                                          • Opcode Fuzzy Hash: 2b91fa647f9f46f324db6d041e479484766e2137a484c7d31420e19634f6b2a6
                                          • Instruction Fuzzy Hash: 62216FB1104301AFC700EB54CC41EAB77E9FB88720F444959F56997390E775E9558B52
                                          Function 04696400 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0469643E
                                          • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 0469644A
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 04696453
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                          • String ID: QTemporaryFile$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                          • API String ID: 10903585-1191378456
                                          • Opcode ID: 77a82d35d5480897069989e762b0fdd94af9fbdde28583c117c62da80ac769c9
                                          • Instruction ID: c839a5b6e0b7153ab6b93e95559319b55f61b0c78af07f152f01c779196fc664
                                          • Opcode Fuzzy Hash: 77a82d35d5480897069989e762b0fdd94af9fbdde28583c117c62da80ac769c9
                                          • Instruction Fuzzy Hash: 1F114F716442019FCB01EFA8EC45EEA37E9FB88610F048828F958D7310E6B9ED159B92
                                          Function 046C24F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046C252E
                                          • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 046C253A
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046C2543
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                          • String ID: QFileSelector$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                          • API String ID: 10903585-3283949406
                                          • Opcode ID: 28d19439ca7552dc2a033ea61da2f1af16e4185972e0c12e961cda48ab372054
                                          • Instruction ID: b8a84d622a40fe534019be927a4c1f322f904b94d048c1b3992d921eca4b7ac6
                                          • Opcode Fuzzy Hash: 28d19439ca7552dc2a033ea61da2f1af16e4185972e0c12e961cda48ab372054
                                          • Instruction Fuzzy Hash: 3C119071640201AFCB10EFA8EC45EEA37E8FB88610F448868F959D7310F678EE15CB52
                                          Function 046F0510 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046F054E
                                          • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 046F055A
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046F0563
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                          • String ID: QFile$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                          • API String ID: 10903585-176789146
                                          • Opcode ID: 97f788084359caed72af106e25c86bc8afefe0d6269b6aea48ecb1496fec1bf2
                                          • Instruction ID: d4a17f5cad62b1e9583a998405229f0804a8591b7205cff660f05e1b77016ab6
                                          • Opcode Fuzzy Hash: 97f788084359caed72af106e25c86bc8afefe0d6269b6aea48ecb1496fec1bf2
                                          • Instruction Fuzzy Hash: 521190716402019FCB00EFA4ED85EEA37E9FB88611F444829F959D7311E2B8FE15DB52
                                          Function 046D4650 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046D468E
                                          • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 046D469A
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046D46A3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                          • String ID: QMimeData$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                          • API String ID: 10903585-2948713046
                                          • Opcode ID: b182d690916c8eecfb34f205bd53e7248158f274a3b14f4d709f91f32c3538f1
                                          • Instruction ID: adf28e5d4f27343f7a6aad8b92ed5b6054632706409ef065011ea5e5e3a39c38
                                          • Opcode Fuzzy Hash: b182d690916c8eecfb34f205bd53e7248158f274a3b14f4d709f91f32c3538f1
                                          • Instruction Fuzzy Hash: A6118E716402019FCB00EBA4EC45EEA37E8FB88610F448878F919D7310E6B8EE158F52
                                          Function 04688620 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0468865E
                                          • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 0468866A
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 04688673
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                          • String ID: QSaveFile$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                          • API String ID: 10903585-2612191645
                                          • Opcode ID: e9748f8b1ee80f5d24999e53b05fb1fc1111c818c62b5b935cb25fed8c44fcb2
                                          • Instruction ID: 8c09199bc2850bf8698eb2ed1983ed456133cf942e1b61fb13bc84340d5c3eab
                                          • Opcode Fuzzy Hash: e9748f8b1ee80f5d24999e53b05fb1fc1111c818c62b5b935cb25fed8c44fcb2
                                          • Instruction Fuzzy Hash: 95115E716402019FCB01EFA8ED45EAA37E9FB88620F444828F958D7311E6B9EE15DB52
                                          Function 046C64B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?size@QBitArray@@QBEHXZ.QT5CORE ref: 046C64F0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046C64F7
                                          • ?count@QBitArray@@QBEH_N@Z.QT5CORE(?), ref: 046C6543
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046C654A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@FromLongLong_$?count@?size@
                                          • String ID: QBitArray$count$count(self) -> intcount(self, on: bool) -> int
                                          • API String ID: 717654462-3156498020
                                          • Opcode ID: 31322886df6235e99c6faf31a6a5f939f0db75600e11a0c3eb6e5131a558ee00
                                          • Instruction ID: 323661c6102029c1c3c2ecc14caa88da5f719c510b9eced1cb44508a267392b5
                                          • Opcode Fuzzy Hash: 31322886df6235e99c6faf31a6a5f939f0db75600e11a0c3eb6e5131a558ee00
                                          • Instruction Fuzzy Hash: 411151B1544201AFC700EF94ED45EAA77E9FB88700F448869F95DC3211E779EE28DB52
                                          Function 0467A620 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?indexOfMethod@QMetaObject@@QBEHPBD@Z.QT5CORE(?), ref: 0467A66F
                                          • _Py_Dealloc.PYTHON3(?), ref: 0467A68D
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0467A697
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?indexDeallocFromLongLong_MetaMethod@Object@@
                                          • String ID: BAA$QMetaObject$indexOfMethod$indexOfMethod(self, method: Optional[str]) -> int
                                          • API String ID: 679079066-365649464
                                          • Opcode ID: c7aac7f6b6240ae9c49b14a5033b47513df006fe9a5e411c489a4b30893c8f10
                                          • Instruction ID: e3f207d35f06e505b8da94594f134f85e46b9758ce242c2cd4ecc277b75165b5
                                          • Opcode Fuzzy Hash: c7aac7f6b6240ae9c49b14a5033b47513df006fe9a5e411c489a4b30893c8f10
                                          • Instruction Fuzzy Hash: C611A0B5104302AFD710EF54CC80DAA77E9FB84320F448968F969C3350E774A9558B42
                                          Function 046D2420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046D245E
                                          • ?lock@QLockFile@@QAE_NXZ.QT5CORE ref: 046D246A
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046D2473
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046D247D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?lock@Bool_File@@FromLockLongRestoreSave
                                          • String ID: QLockFile$lock$lock(self) -> bool
                                          • API String ID: 2058849555-1648657152
                                          • Opcode ID: 7cf513a7c5919401a2985336ae3dce15c6dbae8d5e875b3318410ddf28298428
                                          • Instruction ID: 13f2440c34761e69431767a3861a5e331fa5326c944411e738f4c48fe59de9c8
                                          • Opcode Fuzzy Hash: 7cf513a7c5919401a2985336ae3dce15c6dbae8d5e875b3318410ddf28298428
                                          • Instruction Fuzzy Hash: 42012170544201AFCA00AB54ED49DEA77ECFB44611F448865FD58D3301E3BDAE199BA2
                                          Function 0466A670 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0466A6AE
                                          • ?exec@QThread@@IAEHXZ.QT5CORE ref: 0466A6BA
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 0466A6C3
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0466A6CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?exec@FromLongLong_RestoreSaveThread@@
                                          • String ID: QThread$exec$exec(self) -> int
                                          • API String ID: 349948737-793218595
                                          • Opcode ID: 668a03b73483bc4fc5ac1ce8adb1d9684de544b6ae1e81fb2884e1c65ce7618e
                                          • Instruction ID: e6e751de963498dd333cee2abacfe8b0ad701219a3fecc064211f23e3ee90a58
                                          • Opcode Fuzzy Hash: 668a03b73483bc4fc5ac1ce8adb1d9684de544b6ae1e81fb2884e1c65ce7618e
                                          • Instruction Fuzzy Hash: F4018475244201AFCB00EF64EC49DEA37ECFB88711F444869F949D7300E2B8AE15DB62
                                          Function 046AC6A0 Relevance: 12.1, APIs: 8, Instructions: 117COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001,00000001,00000001), ref: 046AC6E4
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000001), ref: 046AC713
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(00000001), ref: 046AC753
                                          • ??1QByteArray@@QAE@XZ.QT5CORE ref: 046AC797
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000), ref: 046AC7A2
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,00000000,?,?,0474BCE9,?,?,?,?,?,?,?,?,0474B4BA,?,?), ref: 046AC7C2
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?,00000000,?,?,0474BCE9,?,?,?,?,?,?,?,?,0474B4BA,?,?), ref: 046AC7DA
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,0474BCE9,?,?,?,?,?,?,?,?,0474B4BA,?,?), ref: 046AC7E2
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$V0@@$Data@@List$?append@?detach_grow@?dispose@Data@1@Data@1@@
                                          • String ID:
                                          • API String ID: 3083179296-0
                                          • Opcode ID: c5100d2ed3bf214baffc2c01aa22b560fc9f763310dd72558c65a5493d0e422b
                                          • Instruction ID: 7fa7f23034f290566159448c7e4d37cfb38b8b89c479a141ccb67bef5865fe2b
                                          • Opcode Fuzzy Hash: c5100d2ed3bf214baffc2c01aa22b560fc9f763310dd72558c65a5493d0e422b
                                          • Instruction Fuzzy Hash: 1F410476A002158FCB14DF0CC8808A9B3A5FF95314B19456CED1AAB392D731FD26CF91
                                          Function 0040DE30 Relevance: 12.1, APIs: 8, Instructions: 90COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: signal
                                          • String ID:
                                          • API String ID: 1946981877-0
                                          • Opcode ID: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                          • Instruction ID: 529314676596798a44e2e7d48aea7ed491276213eefa766ee39382917f2d3c55
                                          • Opcode Fuzzy Hash: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                          • Instruction Fuzzy Hash: DD3103B09056018AD7206FB8C84432F76D0AF55728F128A2FE4E5DB3D1DB7DD888979B
                                          Function 00407BC0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • wcscpy.MSVCRT ref: 00407C07
                                          • wcslen.MSVCRT ref: 00407C0F
                                          • wcscat.MSVCRT ref: 00407C39
                                          • _wfindfirst.MSVCRT ref: 00407C4C
                                          • _wrmdir.MSVCRT ref: 00407C68
                                          • wcscat.MSVCRT ref: 00407CDE
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcscat$ByteCharMultiWide_wfindfirst_wrmdirwcscpywcslen
                                          • String ID:
                                          • API String ID: 955055573-0
                                          • Opcode ID: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                          • Instruction ID: 812287d127834224555eaebaea1a5f31319f6ec07a572a1decaabcd838263556
                                          • Opcode Fuzzy Hash: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                          • Instruction Fuzzy Hash: 572117B490D3049BD720AF75D88869EBBE4FB84304F118C3EE9C993251E7389585DB9B
                                          Function 00408B00 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                          • calloc.MSVCRT ref: 00408BAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$calloc
                                          • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                          • API String ID: 1374691127-876015163
                                          • Opcode ID: d6a78e633d9bb543a46de6eff9a097cd2261dbab8d0e33fc600cb80726c8ebad
                                          • Instruction ID: 686223d8df53a97fa17e1b733178636a5c74384edd7780f85d5042dc75bc6c3c
                                          • Opcode Fuzzy Hash: d6a78e633d9bb543a46de6eff9a097cd2261dbab8d0e33fc600cb80726c8ebad
                                          • Instruction Fuzzy Hash: AD2118B05083059FD310AF65C64925ABBF4EB84754F04893EE5E8572C1DBB8D8449B9B
                                          Function 004124D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 406COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputwc$memset
                                          • String ID: 0$o
                                          • API String ID: 822753988-4157579757
                                          • Opcode ID: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                          • Instruction ID: b65a98287eddb54592c783ac7525ef4ab93ad80493cd3b98cbaa9a691208da40
                                          • Opcode Fuzzy Hash: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                          • Instruction Fuzzy Hash: 79F16F71E102198FDB14CF68C6942DEBBF1BF44310F15822AE865EB385D778E892CB94
                                          Function 0040F730 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputc$memset
                                          • String ID: 0$o
                                          • API String ID: 2944404495-4157579757
                                          • Opcode ID: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                          • Instruction ID: 9062061d76251826460344fe4ffb90a7e4f33a362718e540e131347e649c7f22
                                          • Opcode Fuzzy Hash: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                          • Instruction Fuzzy Hash: 2BF14D72E002199FDB24DF68D49069EBBB1BF84310F15817AE859BB785D338E946CF84
                                          Function 00406A75 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                          • API String ID: 1294909896-1126984729
                                          • Opcode ID: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                          • Instruction ID: 5837fc7092d7bfd19bff1a36fcf45920a7a04ffe6dc7564dff579a9c2d03099d
                                          • Opcode Fuzzy Hash: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                          • Instruction Fuzzy Hash: 3A61F9B8609301CFD710AF64D48821ABBF0FF49344F81897DE9859B350D7B99859CF2A
                                          Function 00411A40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: %-*.*S$%.*S
                                          • API String ID: 0-812388239
                                          • Opcode ID: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                          • Instruction ID: c23151172c0a1ec719629ee0893607804d1b15add0b79fb5692203c1bf32c755
                                          • Opcode Fuzzy Hash: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                          • Instruction Fuzzy Hash: 7D4196B1A097159BC7109F29D4812DEBBE0AF84794F14C52FE5488B361E33DD9C1CB8A
                                          Function 0464E500 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 100COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?createUuidV5@QUuid@@SA?AV1@ABV1@ABVQByteArray@@@Z.QT5CORE(00000000,?,?,00000010), ref: 0464E562
                                          • ?createUuidV5@QUuid@@SA?AV1@ABV1@ABVQString@@@Z.QT5CORE(00000000,?,?,00000010), ref: 0464E5F0
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          • createUuidV5(ns: QUuid, baseData: Union[QByteArray, bytes, bytearray]) -> QUuidcreateUuidV5(ns: QUuid, baseData: Optional[str]) -> QUuid, xrefs: 0464E631
                                          • createUuidV5, xrefs: 0464E636
                                          • QUuid, xrefs: 0464E63B
                                          • J9J1, xrefs: 0464E537, 0464E5C5
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?createUuidUuid@@$Array@@@ByteString@@@malloc
                                          • String ID: J9J1$QUuid$createUuidV5$createUuidV5(ns: QUuid, baseData: Union[QByteArray, bytes, bytearray]) -> QUuidcreateUuidV5(ns: QUuid, baseData: Optional[str]) -> QUuid
                                          • API String ID: 2433951708-4070722570
                                          • Opcode ID: 110526f4b6bf97d27b940545c7b4be93dea22c5d29cc9bd460d4c6fc11618085
                                          • Instruction ID: a4e91e6256ead8430eb6945537a6a821a36e01fa5576e0f5ad0e0482c3971da6
                                          • Opcode Fuzzy Hash: 110526f4b6bf97d27b940545c7b4be93dea22c5d29cc9bd460d4c6fc11618085
                                          • Instruction Fuzzy Hash: 213160B1104202AFDB01DF94DC40EDA7BE9FB88310F048858F96497320E7BAAE55DF62
                                          Function 046944A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setData@QSortFilterProxyModel@@UAE_NABVQModelIndex@@ABVQVariant@@H@Z.QT5CORE(?,?,?), ref: 04694550
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 0469457D
                                          Strings
                                          • QSortFilterProxyModel, xrefs: 0469459A
                                          • BJ9J1|i, xrefs: 0469450F
                                          • setData(self, index: QModelIndex, value: Any, role: int = Qt.EditRole) -> bool, xrefs: 04694590
                                          • setData, xrefs: 04694595
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setBool_Data@FilterFromIndex@@LongModelModel@@ProxySortVariant@@
                                          • String ID: BJ9J1|i$QSortFilterProxyModel$setData$setData(self, index: QModelIndex, value: Any, role: int = Qt.EditRole) -> bool
                                          • API String ID: 2353091588-1298200029
                                          • Opcode ID: 662b49609e91ee3bd333a1fdcfe81ba74ce44e4aba8e735bcf24d9572c940fca
                                          • Instruction ID: 9057dc8a32fd91b624839dcfe381ab64d733dfc402620477e972f5f6b6617a07
                                          • Opcode Fuzzy Hash: 662b49609e91ee3bd333a1fdcfe81ba74ce44e4aba8e735bcf24d9572c940fca
                                          • Instruction Fuzzy Hash: 32315C71248301AFDB00DF98DC40EAA77E9FB88704F444858F954D7221E77AEE199B52
                                          Function 04704400 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setItemData@QConcatenateTablesProxyModel@@UAE_NABVQModelIndex@@ABV?$QMap@HVQVariant@@@@@Z.QT5CORE(?,?), ref: 04704494
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 047044C1
                                          Strings
                                          • BJ9J1, xrefs: 04704462
                                          • setItemData, xrefs: 047044D9
                                          • setItemData(self, index: QModelIndex, roles: Dict[int, Any]) -> bool, xrefs: 047044D4
                                          • QConcatenateTablesProxyModel, xrefs: 047044DE
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setBool_ConcatenateData@FromIndex@@ItemLongMap@ModelModel@@ProxyTablesVariant@@@@@
                                          • String ID: BJ9J1$QConcatenateTablesProxyModel$setItemData$setItemData(self, index: QModelIndex, roles: Dict[int, Any]) -> bool
                                          • API String ID: 3412095008-4172635554
                                          • Opcode ID: 967396424d5f4a41ae362978a4410e428b97066879e75d75f4ddd962fdbd8b56
                                          • Instruction ID: a2a7b8a4878187029d260c6fee11b98cc52a52278aac56e848a78da9dcc31982
                                          • Opcode Fuzzy Hash: 967396424d5f4a41ae362978a4410e428b97066879e75d75f4ddd962fdbd8b56
                                          • Instruction Fuzzy Hash: D0212AB1648302EFC711DF54DC40EAA77E9FB88304F448864F955C7321D37AE919AB62
                                          Function 04702700 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 73COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setPermissions@QFileDevice@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z.QT5CORE(?), ref: 04702787
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 047027B4
                                          Strings
                                          • BJ1, xrefs: 04702757
                                          • setPermissions(self, permissionSpec: Union[QFileDevice.Permissions, QFileDevice.Permission]) -> bool, xrefs: 047027C7
                                          • setPermissions, xrefs: 047027CC
                                          • QFileDevice, xrefs: 047027D1
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: File$?setBool_Device@@Device@@@@@Flags@FromLongPermission@Permissions@
                                          • String ID: BJ1$QFileDevice$setPermissions$setPermissions(self, permissionSpec: Union[QFileDevice.Permissions, QFileDevice.Permission]) -> bool
                                          • API String ID: 1222903878-2692593308
                                          • Opcode ID: 179e27f7a836d034b96b409491b372880ddc56312b9ca26f66a3070f74759535
                                          • Instruction ID: 1eeb56a4b75c92c17e269448a18f4e6885eb72c3ac73c8ca230a59f7b2f678d6
                                          • Opcode Fuzzy Hash: 179e27f7a836d034b96b409491b372880ddc56312b9ca26f66a3070f74759535
                                          • Instruction Fuzzy Hash: 57213C75244202EFD711DB54DC84EAA77E9FB88310F488899F965C7321D639ED189B22
                                          Function 0040E9C1 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: freembstowcssetlocalewcstombs$realloc
                                          • String ID:
                                          • API String ID: 2323685431-0
                                          • Opcode ID: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                          • Instruction ID: 0ece9848e1b9cb63aa0c7ac93180fa40d32587a4740361e1b5221defc5654884
                                          • Opcode Fuzzy Hash: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                          • Instruction Fuzzy Hash: BA3129B09083159ECB10AF66C1452AEFBF0FF48344F51882FE888A7350E7789995CB86
                                          Function 046E6590 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toULongLong@QLocale@@QBE_KABVQString@@PA_N@Z.QT5CORE(?,?), ref: 046E65FF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Locale@@LongLong@String@@
                                          • String ID: (ob)$BJ1$QLocale$toULongLong$toULongLong(self, s: Optional[str]) -> (int, Optional[bool])
                                          • API String ID: 2541841494-2294449813
                                          • Opcode ID: 936793746f092f1a924e44b43357af99d388f68142dbe55b391987237039f9a9
                                          • Instruction ID: a7dd91d104ca641a8d1725c5ed50c4c5d6c0128fa1ce14ddfb59221089f74c58
                                          • Opcode Fuzzy Hash: 936793746f092f1a924e44b43357af99d388f68142dbe55b391987237039f9a9
                                          • Instruction Fuzzy Hash: 37216DB5248201AFD714DF54CC41EAB7BEAFB88710F448829F96982320D279ED15DB22
                                          Function 046A8600 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 046A866E
                                          • PyLong_FromLong.PYTHON3(?), ref: 046A8680
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QVersionNumber$minorVersion$minorVersion(self) -> int
                                          • API String ID: 2938811853-2765911115
                                          • Opcode ID: ef34e9cfe60400ca2b2155c448f64321063959346d3a809a46bb1f4fcdaca3c5
                                          • Instruction ID: b1eef315c937c596d4c1d9ec5dae41a21a03d99828c7baca0f163d2a8b6d235f
                                          • Opcode Fuzzy Hash: ef34e9cfe60400ca2b2155c448f64321063959346d3a809a46bb1f4fcdaca3c5
                                          • Instruction Fuzzy Hash: E21172B8600601AFDB00EF54EC85D5A77E4FB48705F4848A4E959CB311E27AFE19DB52
                                          Function 046F85D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?submit@QAbstractItemModel@@UAE_NXZ.QT5CORE ref: 046F8639
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F8643
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F865F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong$?submit@AbstractItemModel@@
                                          • String ID: QAbstractItemModel$submit$submit(self) -> bool
                                          • API String ID: 3258403733-373364566
                                          • Opcode ID: b8fc1600bc9f1b19a49a44aa8a96c94e56014c06460d24e54f1c6aa1eadc822d
                                          • Instruction ID: 145972a4acd36e940f3f61efc2050a04e7a815c5ab1b495690907810288170e7
                                          • Opcode Fuzzy Hash: b8fc1600bc9f1b19a49a44aa8a96c94e56014c06460d24e54f1c6aa1eadc822d
                                          • Instruction Fuzzy Hash: 721186702843019FDA00EB58ED45EA633E8EB54610F8844A4FD58C7311E779FD19EB62
                                          Function 046BE690 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?size@QIODevice@@UBE_JXZ.QT5CORE ref: 046BE6F9
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 046BE701
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 046BE718
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$FromLong_$?size@Device@@
                                          • String ID: QIODevice$size$size(self) -> int
                                          • API String ID: 123483533-2243097367
                                          • Opcode ID: abe0b46afad13992b3470203c6064b6130e53b2fd93041a3a327aa337704a290
                                          • Instruction ID: 911a12ab6d8ec11bd0cef23f76491f5c666663570e1fff16e79e9626254699df
                                          • Opcode Fuzzy Hash: abe0b46afad13992b3470203c6064b6130e53b2fd93041a3a327aa337704a290
                                          • Instruction Fuzzy Hash: 4B1142706842019FD610EB64ED45DEA37E9EB84710F488464FC59C7311F27AFD19DBA2
                                          Function 04704590 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 63COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?checkIndex@QAbstractItemModel@@QBE_NABVQModelIndex@@V?$QFlags@W4CheckIndexOption@QAbstractItemModel@@@@@Z.QT5CORE(?,00000000), ref: 04704618
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 0470463D
                                          Strings
                                          • checkIndex, xrefs: 04704655
                                          • BJ9|J1, xrefs: 047045DD
                                          • checkIndex(self, index: QModelIndex, options: Union[QAbstractItemModel.CheckIndexOptions, QAbstractItemModel.CheckIndexOption] = QAbstractItemModel.CheckIndexOption.NoOption) -> bool, xrefs: 04704650
                                          • QAbstractItemModel, xrefs: 0470465A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AbstractItem$?checkBool_CheckFlags@FromIndexIndex@Index@@LongModelModel@@Model@@@@@Option@
                                          • String ID: BJ9|J1$QAbstractItemModel$checkIndex$checkIndex(self, index: QModelIndex, options: Union[QAbstractItemModel.CheckIndexOptions, QAbstractItemModel.CheckIndexOption] = QAbstractItemModel.CheckIndexOption.NoOption) -> bool
                                          • API String ID: 2200960983-3247019021
                                          • Opcode ID: 5b4806fbaac83cc4bc1118117cd64b83d6e60a5d0636b5cb562249d0f8add159
                                          • Instruction ID: a118d5bc322d90468b65d99e281b556723d51573cf7b8b5872af56f5ff72c03d
                                          • Opcode Fuzzy Hash: 5b4806fbaac83cc4bc1118117cd64b83d6e60a5d0636b5cb562249d0f8add159
                                          • Instruction Fuzzy Hash: 6D216D70148305AFDB11EF54DC40EAABBF9FB88300F448859F99583260D7BAE969DF52
                                          Function 00403446 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 58stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strcmp
                                          • String ID: %s%c%s%c%s%c%s$%s%c%s.pkg$Failed to extract %s$\$\$\
                                          • API String ID: 1004003707-2076181140
                                          • Opcode ID: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                          • Instruction ID: 73055d119674c1d8bf47e55e1769eeb00a0baa58503b6758db3226280ebf56de
                                          • Opcode Fuzzy Hash: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                          • Instruction Fuzzy Hash: 602128B1508701ABD7109F25C54414AFBE8BF80719F418D2EE5A8A7390D378EA45CF8A
                                          Function 00407CF0 Relevance: 10.6, APIs: 7, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcscmp$wcscat
                                          • String ID:
                                          • API String ID: 545343207-0
                                          • Opcode ID: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                          • Instruction ID: 66d593373b9ba32e9ef8b9ba0102b03e4299b10aa04248f83024a0eb22297dfe
                                          • Opcode Fuzzy Hash: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                          • Instruction Fuzzy Hash: B5113DB140C7458AD710BF2599842AFBAE4AF50344F02583EE9C597245EB7CA4868B9B
                                          Function 046F8510 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?daysTo@QDateTime@@QBE_JABV1@@Z.QT5CORE(?), ref: 046F8569
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 046F858E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$?daysDateFromLong_Time@@V1@@
                                          • String ID: BJ1$QDateTime$daysTo$daysTo(self, a0: Union[QDateTime, datetime.datetime]) -> int
                                          • API String ID: 1738541556-511274463
                                          • Opcode ID: ebbe6a0811c67a5ba406e09f716208c366ac4c5c9addd9471be0d1e3249bb8f6
                                          • Instruction ID: 28a63a3f19c7fb15a8f1665c2f55df66ec0c2dda0e7c4a7e9dec8ceed83ca3fa
                                          • Opcode Fuzzy Hash: ebbe6a0811c67a5ba406e09f716208c366ac4c5c9addd9471be0d1e3249bb8f6
                                          • Instruction Fuzzy Hash: CE1191B1104201BFD701EB14DC45EAB7BE9FB88350F448968F99A93320D775ED15CB22
                                          Function 0470C540 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginMoveRows@QAbstractItemModel@@IAE_NABVQModelIndex@@HH0H@Z.QT5CORE(?,?,?,?,?), ref: 0470C5B4
                                          • PyBool_FromLong.PYTHON3(?), ref: 0470C5BE
                                          Strings
                                          • beginMoveRows, xrefs: 0470C5D5
                                          • QIdentityProxyModel, xrefs: 0470C5DA
                                          • beginMoveRows(self, sourceParent: QModelIndex, sourceFirst: int, sourceLast: int, destinationParent: QModelIndex, destinationRow: int) -> bool, xrefs: 0470C5D0
                                          • BJ9iiJ9i, xrefs: 0470C57A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginAbstractBool_FromIndex@@ItemLongModelModel@@MoveRows@
                                          • String ID: BJ9iiJ9i$QIdentityProxyModel$beginMoveRows$beginMoveRows(self, sourceParent: QModelIndex, sourceFirst: int, sourceLast: int, destinationParent: QModelIndex, destinationRow: int) -> bool
                                          • API String ID: 4167879251-4148885384
                                          • Opcode ID: 52dc70f27520db9853072b7f413ca8b782540ec3d87cdd511c9a262fc794d52e
                                          • Instruction ID: 381ad1f5e8338c007939ee22f251878932ad0860948d508330f83e639b3258cb
                                          • Opcode Fuzzy Hash: 52dc70f27520db9853072b7f413ca8b782540ec3d87cdd511c9a262fc794d52e
                                          • Instruction Fuzzy Hash: 1F114CB2108201BFC701EF94DD41DABB7F9FB88300F44495DF999D2221E679EA189B22
                                          Function 046D2550 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginMoveColumns@QAbstractItemModel@@IAE_NABVQModelIndex@@HH0H@Z.QT5CORE(?,?,?,?,?), ref: 046D25C4
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D25CE
                                          Strings
                                          • beginMoveColumns, xrefs: 046D25E5
                                          • BJ9iiJ9i, xrefs: 046D258A
                                          • beginMoveColumns(self, sourceParent: QModelIndex, sourceFirst: int, sourceLast: int, destinationParent: QModelIndex, destinationColumn: int) -> bool, xrefs: 046D25E0
                                          • QAbstractTableModel, xrefs: 046D25EA
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginAbstractBool_Columns@FromIndex@@ItemLongModelModel@@Move
                                          • String ID: BJ9iiJ9i$QAbstractTableModel$beginMoveColumns$beginMoveColumns(self, sourceParent: QModelIndex, sourceFirst: int, sourceLast: int, destinationParent: QModelIndex, destinationColumn: int) -> bool
                                          • API String ID: 3301066361-3193133053
                                          • Opcode ID: d65e40f7bdd4c914a0440604e281d0347af90d37c654d965bc95cdf08c3eef3a
                                          • Instruction ID: e0867cdda3fbac875a4b82785acf19038cbe7a631a8e7581594bca19c9b42368
                                          • Opcode Fuzzy Hash: d65e40f7bdd4c914a0440604e281d0347af90d37c654d965bc95cdf08c3eef3a
                                          • Instruction Fuzzy Hash: 16114CB1148201BFC701EF94DD41DABB7F9FB88300F44895DF999D2221E679EA189B62
                                          Function 046D6450 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?rmpath@QDir@@QBE_NABVQString@@@Z.QT5CORE(?), ref: 046D64AD
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046D64D2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?rmpath@Bool_Dir@@FromLongString@@@
                                          • String ID: BJ1$QDir$rmpath$rmpath(self, dirPath: Optional[str]) -> bool
                                          • API String ID: 2833361343-948409342
                                          • Opcode ID: 8116dbc2d5649b86dffcc619f1fb9f5fd30fb54bff29bec53482f14ae68beea5
                                          • Instruction ID: 5a4c849a0862b7eb0a1a8ff61a9c920bd2e35a6a9c8763072df991a330547f50
                                          • Opcode Fuzzy Hash: 8116dbc2d5649b86dffcc619f1fb9f5fd30fb54bff29bec53482f14ae68beea5
                                          • Instruction Fuzzy Hash: 32115EB0148201AFDB01EF54DC40DAA7BE9FB88314F448859F89983221D37AED65DB22
                                          Function 046764E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0467651E
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?readAll@QTextStream@@QAE?AVQString@@XZ.QT5CORE(00000000), ref: 04676535
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 0467653E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?readAll@RestoreSaveStream@@String@@Textmalloc
                                          • String ID: QTextStream$readAll$readAll(self) -> str
                                          • API String ID: 4126734940-3402082874
                                          • Opcode ID: 75a7ecc780d26ba55a6f27ba7cddab8f0e68cb3498b9039da568a789320b3d6e
                                          • Instruction ID: 2de1aa354d97c97ece56e81d283fecaf9b07769d242b23c84d43fd57a07c37fb
                                          • Opcode Fuzzy Hash: 75a7ecc780d26ba55a6f27ba7cddab8f0e68cb3498b9039da568a789320b3d6e
                                          • Instruction Fuzzy Hash: A911A171604201AFDB00EB94EC45EDA77E9FB88710F444864F954D7310E2BDAD15DBA2
                                          Function 0470C600 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toUInt@QByteArray@@QBEIPA_NH@Z.QT5CORE(?,?), ref: 0470C662
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@ByteInt@
                                          • String ID: (ub)$B|i$QByteArray$toUInt$toUInt(self, base: int = 10) -> (int, Optional[bool])
                                          • API String ID: 1228521118-883539502
                                          • Opcode ID: 2336ef2d76a722d730e513e7a2948fff3c7e21f48d3b15713ab93248ab8f289b
                                          • Instruction ID: 9f8ca55b4ec05a44fa939a26c47bddc49f69209bd663a9c66e9be9aefa3c662d
                                          • Opcode Fuzzy Hash: 2336ef2d76a722d730e513e7a2948fff3c7e21f48d3b15713ab93248ab8f289b
                                          • Instruction Fuzzy Hash: DD1170B4144302BFD740EB54CC45FAA77E8FB88700F844858F55893321E6B9E9599B52
                                          Function 046886F0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?decodeData@QAbstractItemModel@@IAE_NHHABVQModelIndex@@AAVQDataStream@@@Z.QT5CORE(?,?,?,?), ref: 04688760
                                          • PyBool_FromLong.PYTHON3(?), ref: 0468876A
                                          Strings
                                          • decodeData(self, row: int, column: int, parent: QModelIndex, stream: QDataStream) -> bool, xrefs: 0468877C
                                          • BiiJ9J9, xrefs: 0468872A
                                          • decodeData, xrefs: 04688781
                                          • QTransposeProxyModel, xrefs: 04688786
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?decodeAbstractBool_DataData@FromIndex@@ItemLongModelModel@@Stream@@@
                                          • String ID: BiiJ9J9$QTransposeProxyModel$decodeData$decodeData(self, row: int, column: int, parent: QModelIndex, stream: QDataStream) -> bool
                                          • API String ID: 1772139635-3123568161
                                          • Opcode ID: f835594dbb3951a13f29df0d539f151779c090a6626e0b4c2b3567a622544fe0
                                          • Instruction ID: 1e6b541a62f41102cfbbc411e39c899b041b83125425fc851264f05dead8e0cd
                                          • Opcode Fuzzy Hash: f835594dbb3951a13f29df0d539f151779c090a6626e0b4c2b3567a622544fe0
                                          • Instruction Fuzzy Hash: C71130B5104205FFDB01EF54DC41DAB77F9FB88304F848859F995D2220E279EA199F52
                                          Function 046C25C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046C25F9
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?location@QLibraryInfo@@SA?AVQString@@W4LibraryLocation@1@@Z.QT5CORE(00000000,?,00000004), ref: 046C260D
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046C2616
                                          Strings
                                          • location(a0: QLibraryInfo.LibraryLocation) -> str, xrefs: 046C263D
                                          • QLibraryInfo, xrefs: 046C2647
                                          • location, xrefs: 046C2642
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_LibraryThread$?location@Info@@Location@1@@RestoreSaveString@@malloc
                                          • String ID: QLibraryInfo$location$location(a0: QLibraryInfo.LibraryLocation) -> str
                                          • API String ID: 3124276058-2717881951
                                          • Opcode ID: 342440f78c71a9a91e2dd8bf804c95d4996321d1078a9571ee489e6130959618
                                          • Instruction ID: f746651212469bc647c2b3cd7d21b3c9909d962a210723ecfa582947e2084ae8
                                          • Opcode Fuzzy Hash: 342440f78c71a9a91e2dd8bf804c95d4996321d1078a9571ee489e6130959618
                                          • Instruction Fuzzy Hash: D3019675540201AFDB10EBA8DC05EDA77E8FB88710F448864FA54C7320E2BD9D15DB61
                                          Function 046EC6F0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toDouble@QJsonValue@@QBENN@Z.QT5CORE ref: 046EC757
                                          • PyFloat_FromDouble.PYTHON3 ref: 046EC76F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DoubleDouble@Float_FromJsonValue@@
                                          • String ID: B|d$QJsonValue$toDouble$toDouble(self, defaultValue: float = 0) -> float
                                          • API String ID: 1135302168-562299158
                                          • Opcode ID: d02ee754bb9bd56614950cf1b1d6a66fdd01c38308e3d7137730f2a5f65494b4
                                          • Instruction ID: 8b87193e4081d619757d89be863e813c62dbfa61322250254cac395b2aec79db
                                          • Opcode Fuzzy Hash: d02ee754bb9bd56614950cf1b1d6a66fdd01c38308e3d7137730f2a5f65494b4
                                          • Instruction Fuzzy Hash: 64110270908706AFD700EF28CC01E9FBBF4FF8A341F444A28F884A6210E775E5958B82
                                          Function 046785F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0467862D
                                          • ?lockForRead@QReadWriteLock@@QAEXXZ.QT5CORE ref: 04678639
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 04678640
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?lockLock@@ReadRead@RestoreSaveWrite
                                          • String ID: QReadWriteLock$lockForRead$lockForRead(self)
                                          • API String ID: 2943477520-1381216646
                                          • Opcode ID: 6682712cc9688bc8cb69f240ff9fccc81346b0201fe78b30ae1c7cd3e2fe7f83
                                          • Instruction ID: 72f95d84560bf9424b8698d8054320034c8104508b98b0da9b2f01103bf14a63
                                          • Opcode Fuzzy Hash: 6682712cc9688bc8cb69f240ff9fccc81346b0201fe78b30ae1c7cd3e2fe7f83
                                          • Instruction Fuzzy Hash: 4D018C70240301AFCB01EF68EC85D9A37E9FB48311F448868F859D7310E379AE16CB52
                                          Function 0464E660 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0464E69D
                                          • ?endResetModel@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 0464E6A9
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 0464E6B0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?endAbstractItemModel@Model@@ResetRestoreSave
                                          • String ID: QStringListModel$endResetModel$endResetModel(self)
                                          • API String ID: 167963407-57652198
                                          • Opcode ID: 59075bb20f3607ff761c428c1755abfe3c57148e4df6011e2180f48aea7a07f0
                                          • Instruction ID: 7cce7e70b7408908e5d823a80aaad52340d372f42b37d474c9a4b2043106fcf0
                                          • Opcode Fuzzy Hash: 59075bb20f3607ff761c428c1755abfe3c57148e4df6011e2180f48aea7a07f0
                                          • Instruction Fuzzy Hash: 17012D742402019FCB01EB64ED45DE977E9FB48311F844968F859D7310E779AE16CF52
                                          Function 0468E610 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 0468E64D
                                          • ?beginResetModel@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 0468E659
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 0468E660
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?beginAbstractItemModel@Model@@ResetRestoreSave
                                          • String ID: QSortFilterProxyModel$beginResetModel$beginResetModel(self)
                                          • API String ID: 4136900167-3842449224
                                          • Opcode ID: 9ea5164b41061b0124d3e5d05281e5bd117d359f6b6dbedc95d5ccab8021d630
                                          • Instruction ID: d327a9a242dd1e4b213348ca5781dc44398e2b5973800f1201a262558bab32c5
                                          • Opcode Fuzzy Hash: 9ea5164b41061b0124d3e5d05281e5bd117d359f6b6dbedc95d5ccab8021d630
                                          • Instruction Fuzzy Hash: 25018C742402019FC700EF64ED45DAA77E8FB48320F444968F959D7310E7B9AE16CF52
                                          Function 0469C740 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?lastIndexOf@?$QVector@VQXmlStreamAttribute@@@@QBEHABVQXmlStreamAttribute@@H@Z.QT5CORE(?), ref: 0469C7AA
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0469C7B1
                                          Strings
                                          • QXmlStreamAttributes, xrefs: 0469C7CD
                                          • BJ9|i, xrefs: 0469C772
                                          • lastIndexOf, xrefs: 0469C7C8
                                          • lastIndexOf(self, value: QXmlStreamAttribute, from_: int = -1) -> int, xrefs: 0469C7C3
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Stream$?lastAttribute@@Attribute@@@@FromIndexLongLong_Of@?$Vector@
                                          • String ID: BJ9|i$QXmlStreamAttributes$lastIndexOf$lastIndexOf(self, value: QXmlStreamAttribute, from_: int = -1) -> int
                                          • API String ID: 3408967243-1408846026
                                          • Opcode ID: 486b538566107bc6ec8745bb9c469224ee2e0776509fa0cedb7c6b48a4f2b43c
                                          • Instruction ID: 935e346f0e0a259a407336a3f61345a12030662defd607848e41adf4cb1dc46f
                                          • Opcode Fuzzy Hash: 486b538566107bc6ec8745bb9c469224ee2e0776509fa0cedb7c6b48a4f2b43c
                                          • Instruction Fuzzy Hash: 840161B0144301AFD701EF54CC45EAE77E9FB48314F448D58F9A5D6320E376EA159B52
                                          Function 046F0770 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isStored@QMetaProperty@@QBE_NPBVQObject@@@Z.QT5CORE ref: 046F07D1
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F07DB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLongMetaObject@@@Property@@Stored@
                                          • String ID: B|J8$QMetaProperty$isStored$isStored(self, object: Optional[QObject] = None) -> bool
                                          • API String ID: 3585964931-1479561283
                                          • Opcode ID: 5cab4686f7ee771d162b30b5b05f722fa6cc7d4d39b25583b90e6b4bc00a0e77
                                          • Instruction ID: 582d4401427190ae28bfb023e826aec378bb2c8233ac917efeaf8b75034171f6
                                          • Opcode Fuzzy Hash: 5cab4686f7ee771d162b30b5b05f722fa6cc7d4d39b25583b90e6b4bc00a0e77
                                          • Instruction Fuzzy Hash: 060140B0144301AFD701DB54EC45FAA77E8FB88714F444868F959D2360D379EA28DF52
                                          Function 046E2440 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PyEval_SaveThread.PYTHON3 ref: 046E246C
                                          • ?flush@QCoreApplication@@SAXXZ.QT5CORE ref: 046E2474
                                          • PyEval_RestoreThread.PYTHON3(00000000), ref: 046E247B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Eval_Thread$?flush@Application@@CoreRestoreSave
                                          • String ID: QCoreApplication$flush$flush()
                                          • API String ID: 3073792758-585210138
                                          • Opcode ID: 9056a71643aac8086b4a55ef21263cb71db8dd82f32be32b88389325005a1c84
                                          • Instruction ID: 11d935934ac1dfa835beb542fd978087ac87e8aaf1cd0bc55f9b294fa4920440
                                          • Opcode Fuzzy Hash: 9056a71643aac8086b4a55ef21263cb71db8dd82f32be32b88389325005a1c84
                                          • Instruction Fuzzy Hash: 17014BB02443019FD701EB64ED49A9937E9FB48320F148969F829C7351E7B9A9118F01
                                          Function 046C4430 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 046C447F
                                          • PyBool_FromLong.PYTHON3(?), ref: 046C4489
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                          • String ID: BJ9$QFileSelector$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                          • API String ID: 544305041-2068243982
                                          • Opcode ID: 7c47a9c9bd02775e8b650f7904af5aaf0b68d0fe1f0867516eb5b07a6076e1d7
                                          • Instruction ID: d05bce39c5782c8fc8be7b50cb199e72cbc03a9b6d16b008f94039dc149ad201
                                          • Opcode Fuzzy Hash: 7c47a9c9bd02775e8b650f7904af5aaf0b68d0fe1f0867516eb5b07a6076e1d7
                                          • Instruction Fuzzy Hash: FA0128B0544302AFDB01DF50EC41EBA77E9FB88610F448869F869D2310E779EA29DB42
                                          Function 0464A4D0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 0464A51F
                                          • PyBool_FromLong.PYTHON3(?), ref: 0464A529
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                          • String ID: BJ9$QPropertyAnimation$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                          • API String ID: 544305041-747358539
                                          • Opcode ID: 27e46d8c66653a67d61d2cae86c12d623842d4d66951adb74d64ee7d66ca4d5f
                                          • Instruction ID: ade8acb848a997a6feb5f5ed1be89568fab2e84e095478d85872e8f84cc6c928
                                          • Opcode Fuzzy Hash: 27e46d8c66653a67d61d2cae86c12d623842d4d66951adb74d64ee7d66ca4d5f
                                          • Instruction Fuzzy Hash: DF012CB0544302AFDB01DB90EC45EAA77E9FB88310F448869F858D3310E779EA159B42
                                          Function 046605C0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?contains@QThreadPool@@QBE_NPBVQThread@@@Z.QT5CORE(?), ref: 0466060F
                                          • PyBool_FromLong.PYTHON3(?), ref: 04660619
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?contains@Bool_FromLongPool@@ThreadThread@@@
                                          • String ID: BJ8$QThreadPool$contains$contains(self, thread: Optional[QThread]) -> bool
                                          • API String ID: 2701345744-696671335
                                          • Opcode ID: 16b12ddd7e42b43c1112dd62bab9fc8ab3d36943099d83fbc4397e0adcb47be3
                                          • Instruction ID: 91c13572c512d17d85080d4e4997f1baacfb3407083a087d2f7eb8327947f306
                                          • Opcode Fuzzy Hash: 16b12ddd7e42b43c1112dd62bab9fc8ab3d36943099d83fbc4397e0adcb47be3
                                          • Instruction Fuzzy Hash: FD014FB0544201AFD701DF54EC45EAA77E9FB88300F448828F998D6310E2B9EA29DB42
                                          Function 046EE5A0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 046EE5EF
                                          • PyBool_FromLong.PYTHON3(?), ref: 046EE5F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                          • String ID: BJ9$QAbstractItemModel$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                          • API String ID: 544305041-581521217
                                          • Opcode ID: 7c27e7c1db5bfa43dbdab5e80b6a2e6fab66ddfddeb0305563959419292750a9
                                          • Instruction ID: 0c4c6c9f4b258b052339e356d8899bc345ea57df0bc4bc8952fe39ca1cb39f02
                                          • Opcode Fuzzy Hash: 7c27e7c1db5bfa43dbdab5e80b6a2e6fab66ddfddeb0305563959419292750a9
                                          • Instruction Fuzzy Hash: 49012CB0544302AFDB11DB54EC45EBA77E9FB88310F448869F859D2310E779EA29DB42
                                          Function 046DA590 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 046DA5DF
                                          • PyBool_FromLong.PYTHON3(?), ref: 046DA5E9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                          • String ID: BJ9$QCoreApplication$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                          • API String ID: 544305041-1889376088
                                          • Opcode ID: e5f3b3e49dc869cbd8e8f541e2c69d8d13a5bfa8b4b70a76916125cc7083f48a
                                          • Instruction ID: 174f48c80e73d6eed996b752b8790d795622cceeaeee8e33758a96aa29c61bbd
                                          • Opcode Fuzzy Hash: e5f3b3e49dc869cbd8e8f541e2c69d8d13a5bfa8b4b70a76916125cc7083f48a
                                          • Instruction Fuzzy Hash: C4014FB0544302AFDB01DF50EC45EBA77E9FB88310F448869F869D2310E779EA15DB52
                                          Function 0467E680 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 0467E6CF
                                          • PyBool_FromLong.PYTHON3(?), ref: 0467E6D9
                                          Strings
                                          • BJ9, xrefs: 0467E6A5
                                          • isSignalConnected(self, signal: QMetaMethod) -> bool, xrefs: 0467E6EB
                                          • QSequentialAnimationGroup, xrefs: 0467E6F5
                                          • isSignalConnected, xrefs: 0467E6F0
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                          • String ID: BJ9$QSequentialAnimationGroup$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                          • API String ID: 544305041-1831637314
                                          • Opcode ID: ee1a75af407cf464a5611a7ebdca353db89e87eba59739a867c3dc86b7c4bd7a
                                          • Instruction ID: 6b895786e2822620ffab82c931a9d772db934fe8c00bbfc0c7873c5d6f829829
                                          • Opcode Fuzzy Hash: ee1a75af407cf464a5611a7ebdca353db89e87eba59739a867c3dc86b7c4bd7a
                                          • Instruction Fuzzy Hash: 9B017CB0144302AFDB01DF50EC41EAA77E9FB88214F448868FC68D2310E379EA19DB42
                                          Function 04698680 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 046986CF
                                          • PyBool_FromLong.PYTHON3(?), ref: 046986D9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                          • String ID: BJ9$QTemporaryFile$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                          • API String ID: 544305041-3157678616
                                          • Opcode ID: 51d25f5952069189cb677518dc8b65e58b0e6364a77d73a49a1cb3a8fc41d032
                                          • Instruction ID: 986c34ec64df46b6775b58ae282c35d43334d73cde80c429834070d757348117
                                          • Opcode Fuzzy Hash: 51d25f5952069189cb677518dc8b65e58b0e6364a77d73a49a1cb3a8fc41d032
                                          • Instruction Fuzzy Hash: 130144B0544302AFDB01DF50DC45DBA77E9FB88310F448869F858D2310E379EA15DB52
                                          Function 00417510 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$HandleModule
                                          • String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
                                          • API String ID: 667068680-1145701848
                                          • Opcode ID: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                          • Instruction ID: 1b2e568be5773464d0952ec9ee83d8ba760180256f55db537a2820630d2abbb3
                                          • Opcode Fuzzy Hash: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                          • Instruction Fuzzy Hash: E1F049B0848204ABD700AF38AD4418A7EF0AA08314F15863FC889C7210E778D888CBAA
                                          Function 0040ED40 Relevance: 9.2, APIs: 6, Instructions: 158stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: _stat$freemallocmemcpystrlen
                                          • String ID:
                                          • API String ID: 2821670080-0
                                          • Opcode ID: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                          • Instruction ID: c5bd95b142fc711015b6ce962a46217c3aa773e4d5f7f4cf9c825846a95b2092
                                          • Opcode Fuzzy Hash: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                          • Instruction Fuzzy Hash: 5B5173715093058FC724DF2AC08026BBBE2AF89304F454D6FE8E49B385D339D956DB8A
                                          Function 0040FCE0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 0
                                          • API String ID: 0-4108050209
                                          • Opcode ID: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                          • Instruction ID: 433f201fbec311e4d545196cfb57db08f817b2de0d536de69a62510c51185dfe
                                          • Opcode Fuzzy Hash: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                          • Instruction Fuzzy Hash: 46C15D71A042058FDB24CF68C48079EBBF1BF89354F18817AE849AB796D339EC45CB95
                                          Function 04692630 Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyGILState_Ensure.PYTHON3 ref: 04692635
                                          • PyObject_CallObject.PYTHON3(?,00000000), ref: 04692642
                                          • _Py_Dealloc.PYTHON3(?), ref: 04692668
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04692682
                                          • PyGILState_Release.PYTHON3(00000000), ref: 04692688
                                          • PyGILState_Release.PYTHON3(00000000), ref: 0469269B
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: State_$DeallocRelease$CallEnsureObjectObject_
                                          • String ID:
                                          • API String ID: 490712733-0
                                          • Opcode ID: ae53a5345ca59eda6175419a6458ba253c190c6e9fcd8b2a61a2836291171ad0
                                          • Instruction ID: dfa4c66f089c943726a14014afca96bd4befae178e58db2af06d319a5baf8a7b
                                          • Opcode Fuzzy Hash: ae53a5345ca59eda6175419a6458ba253c190c6e9fcd8b2a61a2836291171ad0
                                          • Instruction Fuzzy Hash: A901267660030057DB101B38AC88A6677ADEF943797180FA5F92A8A3C0FBB6BC618750
                                          Function 00412A90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 0
                                          • API String ID: 0-4108050209
                                          • Opcode ID: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                          • Instruction ID: 5dacb983aef9c9090e06cba1bb9e4627a9a1d687151f3e630a54116cb97c77b1
                                          • Opcode Fuzzy Hash: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                          • Instruction Fuzzy Hash: ABC15C71A042058BDB14CF28C6847DEBBF1BF88340F19855AE949EB355E378EC91CB99
                                          Function 046EA480 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 118timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ??H@YA?AVQDeadlineTimer@@V0@_J@Z.QT5CORE(00000000), ref: 046EA4E7
                                          • ??H@YA?AVQDeadlineTimer@@V0@_J@Z.QT5CORE(00000000), ref: 046EA55D
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DeadlineTimer@@V0@_$malloc
                                          • String ID: J9n$nJ9
                                          • API String ID: 2597226476-1089117124
                                          • Opcode ID: 98a6ab4ebdc3c0f1cb328409b6174c737fec79bb3209bc1619815210c2912208
                                          • Instruction ID: 804db31bc5244405a4240f6282878e2dc2d55c79a882750dd4915ff6502011b8
                                          • Opcode Fuzzy Hash: 98a6ab4ebdc3c0f1cb328409b6174c737fec79bb3209bc1619815210c2912208
                                          • Instruction Fuzzy Hash: B541C271604201AFE700DF68DC41EEB37E9EF84314F448868F965CB261E675AD58CBA2
                                          Function 04642750 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?match@QRegularExpression@@QBE?AVQRegularExpressionMatch@@ABVQString@@HW4MatchType@1@V?$QFlags@W4MatchOption@QRegularExpression@@@@@Z.QT5CORE(00000000,?,?,?,00000004), ref: 04642819
                                          Strings
                                          • BJ1|iEJ1, xrefs: 046427CA
                                          • match, xrefs: 04642877
                                          • QRegularExpression, xrefs: 0464287C
                                          • match(self, subject: Optional[str], offset: int = 0, matchType: QRegularExpression.MatchType = QRegularExpression.NormalMatch, matchOptions: Union[QRegularExpression.MatchOptions, QRegularExpression.MatchOption] = QRegularExpression.NoMatchOption) -> QRegularE, xrefs: 04642872
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Regular$Match$?match@ExpressionExpression@@Expression@@@@@Flags@Match@@Option@String@@Type@1@malloc
                                          • String ID: BJ1|iEJ1$QRegularExpression$match$match(self, subject: Optional[str], offset: int = 0, matchType: QRegularExpression.MatchType = QRegularExpression.NormalMatch, matchOptions: Union[QRegularExpression.MatchOptions, QRegularExpression.MatchOption] = QRegularExpression.NoMatchOption) -> QRegularE
                                          • API String ID: 672430529-2860083789
                                          • Opcode ID: f3151fc407d7b70af98aebcb2f3395be3486a862051b4963c4e678e885770fd4
                                          • Instruction ID: 734a32a78b2a92ea203bd54eaa9416e85d218591d82e5719a51d37f4cfb634a4
                                          • Opcode Fuzzy Hash: f3151fc407d7b70af98aebcb2f3395be3486a862051b4963c4e678e885770fd4
                                          • Instruction Fuzzy Hash: 3F31F6B5108301AFD701CF91DC80F9BBBE9FB88718F004919F99596220D3BAEA58DF52
                                          Function 04652520 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?itemData@QStringListModel@@UBE?AV?$QMap@HVQVariant@@@@ABVQModelIndex@@@Z.QT5CORE(?,?), ref: 046525AA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?itemData@Index@@@ListMap@ModelModel@@StringVariant@@@@
                                          • String ID: BJ9$QStringListModel$itemData$itemData(self, index: QModelIndex) -> Dict[int, Any]
                                          • API String ID: 3130161626-433527703
                                          • Opcode ID: a79eb1ca204b5925cc51105fd7c2a8b0e0612b8f1ae16e28be75300290d25ac3
                                          • Instruction ID: aa91b2a1e68275034487ead43b2f1f35b2a7650f6fff61b6d8da54c1d20de6f6
                                          • Opcode Fuzzy Hash: a79eb1ca204b5925cc51105fd7c2a8b0e0612b8f1ae16e28be75300290d25ac3
                                          • Instruction Fuzzy Hash: 01315AB02443029FD714DF64D890EAA77E9EB88310F4448A8F95A87330E679ED59DF62
                                          Function 046F2620 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?itemData@QAbstractItemModel@@UBE?AV?$QMap@HVQVariant@@@@ABVQModelIndex@@@Z.QT5CORE(?,?), ref: 046F26AA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?itemAbstractData@Index@@@ItemMap@ModelModel@@Variant@@@@
                                          • String ID: BJ9$QAbstractItemModel$itemData$itemData(self, index: QModelIndex) -> Dict[int, Any]
                                          • API String ID: 2082879162-2564319942
                                          • Opcode ID: 52060652217f8d3f71f3eb8bf33a814e883ff43ef30affd4402bfc54c0e4144b
                                          • Instruction ID: 13d35d45b8358f0f7405e9a259825130e08de941421f1fe3ff7cf5a5ad4239bb
                                          • Opcode Fuzzy Hash: 52060652217f8d3f71f3eb8bf33a814e883ff43ef30affd4402bfc54c0e4144b
                                          • Instruction Fuzzy Hash: 0E317AB02442029FD714DF54DC90EAA77E9FB88310F448468FA9A87320E679E959DF61
                                          Function 046CC420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyType_IsSubtype.PYTHON3(?,0460C9D8), ref: 046CC438
                                          • ??_5QBitArray@@QAEAAV0@ABV0@@Z.QT5CORE(?), ref: 046CC4A5
                                          • _Py_Dealloc.PYTHON3(?), ref: 046CC4D7
                                          • PyErr_Clear.PYTHON3 ref: 046CC4EC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ??_5Array@@ClearDeallocErr_SubtypeType_V0@@
                                          • String ID: 1J9
                                          • API String ID: 2187719691-2407233842
                                          • Opcode ID: 593519371485a550c85cb51223ccdb4294025b320d485dd64a2b10999e4312ea
                                          • Instruction ID: d76d9c753c4b8f2176b2bead4cb72afa1f67f0271929ff22f89848bc7cfd4016
                                          • Opcode Fuzzy Hash: 593519371485a550c85cb51223ccdb4294025b320d485dd64a2b10999e4312ea
                                          • Instruction Fuzzy Hash: EC216D712003009FC714CF68E8849BA73E9FB88365B24856DF86AC7390E735ED12CB51
                                          Function 00407564 Relevance: 8.8, APIs: 7, Instructions: 77stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlen$malloc
                                          • String ID:
                                          • API String ID: 3157260142-0
                                          • Opcode ID: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                          • Instruction ID: 6a25df0a465119ab13b362e17adcb34b3197186f0404beced398dc7aaf439a95
                                          • Opcode Fuzzy Hash: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                          • Instruction Fuzzy Hash: B5217175A0A7059BC710AF6988846ABB7E0FF84750F46493EF8C497341FA39EC41C796
                                          Function 046D4560 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?flags@QAbstractTableModel@@UBE?AV?$QFlags@W4ItemFlag@Qt@@@@ABVQModelIndex@@@Z.QT5CORE(?,?), ref: 046D45EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?flags@AbstractFlag@Flags@Index@@@ItemModelModel@@Qt@@@@Table
                                          • String ID: BJ9$QAbstractTableModel$flags$flags(self, index: QModelIndex) -> Qt.ItemFlags
                                          • API String ID: 4170894332-3615385505
                                          • Opcode ID: b6dc7fa58473a9a616abac46c75ada15f0a91239ccdacdb19cfa74b50881dc98
                                          • Instruction ID: 769986bd3b9109e286da18ae68142d8223a6e7c4e8737a84c678171c1ae9ecf3
                                          • Opcode Fuzzy Hash: b6dc7fa58473a9a616abac46c75ada15f0a91239ccdacdb19cfa74b50881dc98
                                          • Instruction Fuzzy Hash: BB219DB1644202AFD700DFA4CC81EEA77E8EB88310F044864F959C7321E679FD59DB52
                                          Function 04690570 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?parent@QTransposeProxyModel@@UBE?AVQModelIndex@@ABV2@@Z.QT5CORE(?,?), ref: 046905FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?parent@Index@@ModelModel@@ProxyTransposeV2@@
                                          • String ID: BJ9$QTransposeProxyModel$parent$parent(self, index: QModelIndex) -> QModelIndex
                                          • API String ID: 3819584892-651085198
                                          • Opcode ID: e8853f3f787aba6c05ebb9987effaa2d7a3a7edd56958174526597aa27107fe3
                                          • Instruction ID: 6026a99abfb04988d1200e269b81866acaee0d5f6dcb696f660e7c5add01b11e
                                          • Opcode Fuzzy Hash: e8853f3f787aba6c05ebb9987effaa2d7a3a7edd56958174526597aa27107fe3
                                          • Instruction Fuzzy Hash: 542192B0244302AFDB00DBA4DC81EE677E9FB88310F444464F959D7220E7B5EE95DB52
                                          Function 046746D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?toStringList@QUrl@@SA?AVQStringList@@ABV?$QList@VQUrl@@@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z.QT5CORE(00000000,?,00000004,00000004), ref: 0467475A
                                          Strings
                                          • toStringList, xrefs: 046747B8
                                          • QUrl, xrefs: 046747BD
                                          • toStringList(uris: Iterable[QUrl], options: QUrl.FormattingOptions = QUrl.PrettyDecoded) -> List[str], xrefs: 046747B3
                                          • J1|J1, xrefs: 0467471E
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FormattingList@StringUrl@@$ComponentFlags@List@@Option@Option@2@@@@Url@@@@malloc
                                          • String ID: J1|J1$QUrl$toStringList$toStringList(uris: Iterable[QUrl], options: QUrl.FormattingOptions = QUrl.PrettyDecoded) -> List[str]
                                          • API String ID: 1006507870-3707491150
                                          • Opcode ID: 9d715c27cdfcb348069cbbaa03672a4416512080e875765ffa77f41b733d4348
                                          • Instruction ID: 46e839c27af9adf7753d0eb2a176680dc992e105407c251aa50f7d148fbf6794
                                          • Opcode Fuzzy Hash: 9d715c27cdfcb348069cbbaa03672a4416512080e875765ffa77f41b733d4348
                                          • Instruction Fuzzy Hash: 97217AB5108301AFD701DF94CC44F9A7BE6FB88314F444818FA5497220E3BAEA54DF92
                                          Function 0464C4D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?updateState@QPropertyAnimation@@MAEXW4State@QAbstractAnimation@@0@Z.QT5CORE(?,?), ref: 0464C552
                                          Strings
                                          • updateState(self, newState: QAbstractAnimation.State, oldState: QAbstractAnimation.State), xrefs: 0464C583
                                          • BEE, xrefs: 0464C520
                                          • QPropertyAnimation, xrefs: 0464C58D
                                          • updateState, xrefs: 0464C588
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: State@$?updateAbstractAnimation@@Animation@@0@Property
                                          • String ID: BEE$QPropertyAnimation$updateState$updateState(self, newState: QAbstractAnimation.State, oldState: QAbstractAnimation.State)
                                          • API String ID: 2858365248-1445659880
                                          • Opcode ID: ae97638d5621e6f5e4e78a49d672c1f54f79e64eab76511347b2a616451512f3
                                          • Instruction ID: bb444fe2210d0f50a89cc57115fae50ea84cacb2371ab806e2c5c436aae7f04f
                                          • Opcode Fuzzy Hash: ae97638d5621e6f5e4e78a49d672c1f54f79e64eab76511347b2a616451512f3
                                          • Instruction Fuzzy Hash: 3B217CB0245202AFDB44DF58D981DAA77E9FB88310F448868F869C7360E679ED159B22
                                          Function 0468C630 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?changePersistentIndexList@QAbstractItemModel@@IAEXABV?$QList@VQModelIndex@@@@0@Z.QT5CORE(?,?), ref: 0468C6A4
                                          Strings
                                          • changePersistentIndexList(self, from_: Iterable[QModelIndex], to: Iterable[QModelIndex]), xrefs: 0468C6FF
                                          • QSortFilterProxyModel, xrefs: 0468C709
                                          • BJ1J1, xrefs: 0468C676
                                          • changePersistentIndexList, xrefs: 0468C704
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List@$?changeAbstractIndexIndex@@@@0@ItemModelModel@@Persistent
                                          • String ID: BJ1J1$QSortFilterProxyModel$changePersistentIndexList$changePersistentIndexList(self, from_: Iterable[QModelIndex], to: Iterable[QModelIndex])
                                          • API String ID: 1575864148-3929898962
                                          • Opcode ID: 4af183903c6af559a11c2ff78221ee54de7ff59dfe2daf3b93772c545c1a8bda
                                          • Instruction ID: 56ca4d90c6489b398e868db24dfd49d99b75d550b382ed6befbf948af90aafae
                                          • Opcode Fuzzy Hash: 4af183903c6af559a11c2ff78221ee54de7ff59dfe2daf3b93772c545c1a8bda
                                          • Instruction Fuzzy Hash: 38213B75214201AFC701DF58DC40EAA7BF9FB88310F44895CF96993221D7BAA9199F52
                                          Function 0466A4E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?userInfo@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(00000000,00000004), ref: 0466A565
                                          Strings
                                          • B|J1, xrefs: 0466A522
                                          • QUrl, xrefs: 0466A5B0
                                          • userInfo(self, options: Union[QUrl.ComponentFormattingOptions, QUrl.ComponentFormattingOption] = QUrl.PrettyDecoded) -> str, xrefs: 0466A5A6
                                          • userInfo, xrefs: 0466A5AB
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?userComponentFlags@FormattingInfo@Option@String@@Url@@Url@@@@@malloc
                                          • String ID: B|J1$QUrl$userInfo$userInfo(self, options: Union[QUrl.ComponentFormattingOptions, QUrl.ComponentFormattingOption] = QUrl.PrettyDecoded) -> str
                                          • API String ID: 297090289-704602060
                                          • Opcode ID: 6f01a39160dfbf5aa59c86aae140377127f0f60f5efd44abcf2390c70d477952
                                          • Instruction ID: 19bf8a0db0d80280b725cd275b1404054d4722151025a2ef1878c24ceb5baa0c
                                          • Opcode Fuzzy Hash: 6f01a39160dfbf5aa59c86aae140377127f0f60f5efd44abcf2390c70d477952
                                          • Instruction Fuzzy Hash: 3B216AB5244301AFD701DF54DC41FABBBEAFB88714F408818FA5996320D3BAE915DB52
                                          Function 04656700 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?queryItems@QUrlQuery@@QBE?AV?$QList@U?$QPair@VQString@@V1@@@@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z.QT5CORE(00000000,00000004), ref: 04656785
                                          Strings
                                          • queryItems, xrefs: 046567CB
                                          • B|J1, xrefs: 04656742
                                          • queryItems(self, options: Union[QUrl.ComponentFormattingOptions, QUrl.ComponentFormattingOption] = QUrl.PrettyDecoded) -> List[Tuple[str, str]], xrefs: 046567C6
                                          • QUrlQuery, xrefs: 046567D0
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?queryComponentFlags@FormattingItems@List@Option@Pair@Query@@String@@Url@@@@@V1@@@@@malloc
                                          • String ID: B|J1$QUrlQuery$queryItems$queryItems(self, options: Union[QUrl.ComponentFormattingOptions, QUrl.ComponentFormattingOption] = QUrl.PrettyDecoded) -> List[Tuple[str, str]]
                                          • API String ID: 2160803688-2947170263
                                          • Opcode ID: b4657f9736729ad25070d5beae93ce4567788b63581301ac1a8198d30ddf5e87
                                          • Instruction ID: 1b82e59cb92d9cce4510e8327c7f92e89387e5172e6f3ab4285c0b6f40f934ec
                                          • Opcode Fuzzy Hash: b4657f9736729ad25070d5beae93ce4567788b63581301ac1a8198d30ddf5e87
                                          • Instruction Fuzzy Hash: 7F219AB5104201AFD700EF54DC40FAB7BE9FB88710F408858F95987320D3BAEA15DB52
                                          Function 04650470 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046504E8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QWinEventNotifier$disconnectNotify$disconnectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-3669494357
                                          • Opcode ID: 927e3168e016600ff20d476fa219e2bbaefe5bdc0d1b544721f3d3329e1fe667
                                          • Instruction ID: 7aaf578618b3bbc66dc3cbf6c6d245d30bc7e0dac49f3623c4e51cad89c48c07
                                          • Opcode Fuzzy Hash: 927e3168e016600ff20d476fa219e2bbaefe5bdc0d1b544721f3d3329e1fe667
                                          • Instruction Fuzzy Hash: AA211774284302AFC700DB64E981EAA77E9EB88314F448868FC59D7321E67AED55DB12
                                          Function 046A4470 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046A44E8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QSocketNotifier$timerEvent$timerEvent(self, a0: Optional[QTimerEvent])
                                          • API String ID: 12784630-4057188810
                                          • Opcode ID: 7224205eb29c534cd05061604a858c47c95cd54b03a942579e1029de142ebd19
                                          • Instruction ID: 12ff8a3cbd33030dfd7b937b6f212ebc443c9a0fb705903c8c5088454f62ad12
                                          • Opcode Fuzzy Hash: 7224205eb29c534cd05061604a858c47c95cd54b03a942579e1029de142ebd19
                                          • Instruction Fuzzy Hash: 40214DB42443019FC700DB54EC85EAA37E9EB48318F444464F858C7321EABAED55DF12
                                          Function 046CA440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046CA4B8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QItemSelectionModel$customEvent$customEvent(self, a0: Optional[QEvent])
                                          • API String ID: 12784630-898955145
                                          • Opcode ID: 583447a5bd3d596fadc05a725b784b523614808033a2e2d98305ac9bdb45f517
                                          • Instruction ID: 0315f8d55f1a3d662bf35df21e6db9db1c9c775fe656183b0c189c1f693de2a6
                                          • Opcode Fuzzy Hash: 583447a5bd3d596fadc05a725b784b523614808033a2e2d98305ac9bdb45f517
                                          • Instruction Fuzzy Hash: DD215E702443059FC740DBA4E885EAA77E9FB88314F048468F859C7320E679F919DB52
                                          Function 046F8440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046F84B8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QAbstractState$timerEvent$timerEvent(self, a0: Optional[QTimerEvent])
                                          • API String ID: 12784630-2350595398
                                          • Opcode ID: 6fd5624c7da8c372155a7f846aec3f0e6a3933395524ad875f46cfdbf4700d61
                                          • Instruction ID: 940330313279eeebbcf908c6778ad6b54784d438005003538f321f0e5b78265e
                                          • Opcode Fuzzy Hash: 6fd5624c7da8c372155a7f846aec3f0e6a3933395524ad875f46cfdbf4700d61
                                          • Instruction Fuzzy Hash: EC214A74244302AFD700EB54EC85EAA77E9FB48310F444468F998C7321E77AED59DB12
                                          Function 046DE4F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046DE568
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QAnimationGroup$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-1241287562
                                          • Opcode ID: a2122d3cd74df15f4b2c7b7e3c3b0469e95daacc9303ca6b91ab1e73c4e2a321
                                          • Instruction ID: 36174c80cc72b6717276abcbc8f3e193d97703b7adcae14392f063f670f78bff
                                          • Opcode Fuzzy Hash: a2122d3cd74df15f4b2c7b7e3c3b0469e95daacc9303ca6b91ab1e73c4e2a321
                                          • Instruction Fuzzy Hash: AB211AB4644202AFC700DF64D881EA677E9FB88350F448968F859CB320F77AEE15DB12
                                          Function 046884C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04688538
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QSortFilterProxyModel$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                          • API String ID: 12784630-2050599878
                                          • Opcode ID: c8e62e3c3529cb52f275b254a4195e8932821358e1cc28fae8c9964763e881c4
                                          • Instruction ID: e715475ab60fe7b01b063b160ee34eb11e8654dadc20b0a22ca8fcfaa4063ac4
                                          • Opcode Fuzzy Hash: c8e62e3c3529cb52f275b254a4195e8932821358e1cc28fae8c9964763e881c4
                                          • Instruction Fuzzy Hash: 0A214AB52443019FC750EB64E881EA677E9EB88320F848568FC59C7321E77AED15DB12
                                          Function 046624D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04662548
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QStateMachine$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-3325959791
                                          • Opcode ID: e4e21042da02f38f61a2a9ac7782b7a476a5bc63c0b31f87fd445b6e929b1dcb
                                          • Instruction ID: 0e333ff75030001c6579ee14d9d27b0001b94041f891e3a6a4d49cdf8619845f
                                          • Opcode Fuzzy Hash: e4e21042da02f38f61a2a9ac7782b7a476a5bc63c0b31f87fd445b6e929b1dcb
                                          • Instruction Fuzzy Hash: 6D214D70244302AFC710DB68D991EA637E9FB88314F4448A4FC59D7320E675ED15DB12
                                          Function 046F24D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046F2548
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QFile$disconnectNotify$disconnectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-4017279118
                                          • Opcode ID: de597b28e14fb6c2c75b9e40824dbb90d4b9ca928b3864bab3806ac8b387abb5
                                          • Instruction ID: 3277b7d9547088c6291aaf41348a6585f68c5800a8a06459a5098ab1ad59c1ca
                                          • Opcode Fuzzy Hash: de597b28e14fb6c2c75b9e40824dbb90d4b9ca928b3864bab3806ac8b387abb5
                                          • Instruction Fuzzy Hash: 32214D742443029FC700DB58EC91EA637E9EB88314F4444A4F969C7320E67AFD55DF51
                                          Function 046E8480 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046E84F8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QAbstractTransition$customEvent$customEvent(self, a0: Optional[QEvent])
                                          • API String ID: 12784630-80682383
                                          • Opcode ID: 86fac79faf2d06a2955f351b87161cdc2f2e60469bd18985e9e33d1a2f0f9a80
                                          • Instruction ID: 83a4b868b8be5b020363229100425b60a0fde6204bb752d4721eb194b66e516a
                                          • Opcode Fuzzy Hash: 86fac79faf2d06a2955f351b87161cdc2f2e60469bd18985e9e33d1a2f0f9a80
                                          • Instruction Fuzzy Hash: D0214AB0245301AFC740EF65E981EA637E9FB88310F448869F859C7320F639FD199B12
                                          Function 04664490 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04664508
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QSharedMemory$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-1644337855
                                          • Opcode ID: 448276560908abefbb15c9cafb137ce43c0db0a09f86a529eca30fc9e1f56103
                                          • Instruction ID: 37424ba492dc8083c54c801cbe7fc36903459dd6e89f9685537721c11b4edab3
                                          • Opcode Fuzzy Hash: 448276560908abefbb15c9cafb137ce43c0db0a09f86a529eca30fc9e1f56103
                                          • Instruction Fuzzy Hash: A6211AB4244302AFC750DB54E881EAA77E9FB48314F444865FC5AC7320EB79EE15DB16
                                          Function 046445F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04644668
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QTimer$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                          • API String ID: 12784630-3487185871
                                          • Opcode ID: f8561e180955334c317f5988c58f253226fdb87f394cab7b6d16c0d54a47d45b
                                          • Instruction ID: 747335238539b04b531bfe8fe6a43b2f4f0756e44efdeddab77ffcd0aac0e0bf
                                          • Opcode Fuzzy Hash: f8561e180955334c317f5988c58f253226fdb87f394cab7b6d16c0d54a47d45b
                                          • Instruction Fuzzy Hash: BB211AB4348201AFDB40DF64D882EAA77E9EB88314F444469FC59C7320E67AF9159F12
                                          Function 046D05F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046D0668
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QObject$customEvent$customEvent(self, a0: Optional[QEvent])
                                          • API String ID: 12784630-660042557
                                          • Opcode ID: 9f47db90b03f9de0a67f5ec7524a3761f4ff4f9c388defdb380adbbb77ff23c4
                                          • Instruction ID: fd3660eb50f0e801ea3214a5c6880b2f08bf107d1eddbaa3d0ef81d7fd3cccc3
                                          • Opcode Fuzzy Hash: 9f47db90b03f9de0a67f5ec7524a3761f4ff4f9c388defdb380adbbb77ff23c4
                                          • Instruction Fuzzy Hash: DE2159B0B44246AFC740DF64DD81EAA37E9FB88314F444868F859D7320E679F91ADB12
                                          Function 046E8660 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046E86D8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QAbstractTransition$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-4119980103
                                          • Opcode ID: 28f13e724218fe85b9e4b572a26f24b5b819b47c690ea05817513c79e6f100b4
                                          • Instruction ID: 94239cc3f88103236616caf83045bb4044b956a72a197b6e97921d769b116dee
                                          • Opcode Fuzzy Hash: 28f13e724218fe85b9e4b572a26f24b5b819b47c690ea05817513c79e6f100b4
                                          • Instruction Fuzzy Hash: E0214AB02443029FCB00EF65D981EA637E9FB48214F084869F859C7320E779EA19DB12
                                          Function 046D2610 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046D2688
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QLibrary$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-1961776447
                                          • Opcode ID: 07d897d43206f0dbbb256ac059bd68daa2c05edd80a181f9997781e1f08ba5c8
                                          • Instruction ID: 820d6ece5431e6c4f3e8d62059485628eee2de9f51609abb9f582ab9ad88ebde
                                          • Opcode Fuzzy Hash: 07d897d43206f0dbbb256ac059bd68daa2c05edd80a181f9997781e1f08ba5c8
                                          • Instruction Fuzzy Hash: 74215CB47443029FD700DB64DC91EA637E9FB88310F4844A8F859C7320E77AEA19DB52
                                          Function 046CC6E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046CC758
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QAbstractTableModel$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                          • API String ID: 12784630-3848693096
                                          • Opcode ID: 5bf169e36a250e0d17449f948e6164c5bcbc542c4ba4534193be05d7140f5202
                                          • Instruction ID: 42c92a48e72c70b9aed8b226d13e812fac8829c8128c8a4a702de7ed23f54c6c
                                          • Opcode Fuzzy Hash: 5bf169e36a250e0d17449f948e6164c5bcbc542c4ba4534193be05d7140f5202
                                          • Instruction Fuzzy Hash: C1215CB42842019FC740DF64D981EA677E9FB59310F044469FC59C7320E77AF91ADB62
                                          Function 046546C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04654738
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QVariantAnimation$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                          • API String ID: 12784630-1636517633
                                          • Opcode ID: 649dfd2bfd37169c9d7e98fa49256873b3e431129fd735f65cc2ddd4c7f62c4f
                                          • Instruction ID: 0433c0abce35dc6f95e085b3d2a70a5da51580b4a1bfad43e2bb31d244ad11ce
                                          • Opcode Fuzzy Hash: 649dfd2bfd37169c9d7e98fa49256873b3e431129fd735f65cc2ddd4c7f62c4f
                                          • Instruction Fuzzy Hash: FA216D74244202AFC740DF54DC81EAA77E9FB49314F4484A8FC59C7321EA79F959DB12
                                          Function 0465A6A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 0465A718
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QThreadPool$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-1566588677
                                          • Opcode ID: 5e841b80fb4f3f5d6f9be292ade0781a1bb7880e2870bb5bcd2b9c064e4ff9a6
                                          • Instruction ID: 59fb6108c40474187e9a95803fbd842cf22c825cb6b0cd59d22bb1bc1fe4ca92
                                          • Opcode Fuzzy Hash: 5e841b80fb4f3f5d6f9be292ade0781a1bb7880e2870bb5bcd2b9c064e4ff9a6
                                          • Instruction Fuzzy Hash: 7D211A74244202AFCB00DBA4D991EA677E9FB88350F444568FC59C7320E779EA15DB12
                                          Function 046606A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04660718
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QPauseAnimation$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-2312154919
                                          • Opcode ID: 571fdbb88fbcb0851e8db78d15e608a19fd3d1b6b685145110cdb36603037b76
                                          • Instruction ID: 7789d71e4ad080054a2468ac979d47b2a40f27c61b36418df1e6d5cb8db52141
                                          • Opcode Fuzzy Hash: 571fdbb88fbcb0851e8db78d15e608a19fd3d1b6b685145110cdb36603037b76
                                          • Instruction Fuzzy Hash: A6212974244202AFDB04DB54E881EAA7BE9FB88350F444468F86AD7320E779EE15DF12
                                          Function 046626A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04662718
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QStateMachine$disconnectNotify$disconnectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-567199010
                                          • Opcode ID: fd2daeb3cf3901acce9bda9d1d8aaad148fc2d678ac43704bf484a31432aa399
                                          • Instruction ID: b30b98553853e789ca57271fc0f7a33ad57ef6751ad9fc73b8f2212e71387123
                                          • Opcode Fuzzy Hash: fd2daeb3cf3901acce9bda9d1d8aaad148fc2d678ac43704bf484a31432aa399
                                          • Instruction Fuzzy Hash: 8A215CB4344302AFCB00EB64E891EA63BE9FB88314F4448A4F859C7320E779ED15DB52
                                          Function 046646B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04664728
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QSharedMemory$disconnectNotify$disconnectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-320503290
                                          • Opcode ID: 02c969664dcc61d2c23c652cd0ebf753a907ab5e9e3291a6f54ce271994d4c6c
                                          • Instruction ID: e6217a29dd08366fe93d2c1720f4b3454a50e7d2710cdd6148b9cbf85b9cb68a
                                          • Opcode Fuzzy Hash: 02c969664dcc61d2c23c652cd0ebf753a907ab5e9e3291a6f54ce271994d4c6c
                                          • Instruction Fuzzy Hash: 32215C74244302AFC740DB54E881EA637E9FB49354F444868F869C7320EB79ED15DF16
                                          Function 046A46B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046A4728
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QSocketNotifier$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                          • API String ID: 12784630-1874711154
                                          • Opcode ID: 6ea26cdbe2646752c7b04a4abdaa6e8b505f9cd50f562ea133c1f65e0da93218
                                          • Instruction ID: 44e61b963e2a250406eb66d7215a2aa731e7f385e1f1b4dd3ce3f2006b0963be
                                          • Opcode Fuzzy Hash: 6ea26cdbe2646752c7b04a4abdaa6e8b505f9cd50f562ea133c1f65e0da93218
                                          • Instruction Fuzzy Hash: 52214A742442419FC700DB54DC81EAA77E9EB49314F588468F869C7320E6B9FD25DF12
                                          Function 046F8770 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 046F87E8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QConcatenateTablesProxyModel$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                          • API String ID: 12784630-780958934
                                          • Opcode ID: 23ef701ab7b21fa014fab5ac25e25b663ed0b9eafcaf1a759c440074eedd608e
                                          • Instruction ID: 0bc58ac7f824a04b3f9f013d33254a966797b4bc7f424e8c9b448d0e60a2d31a
                                          • Opcode Fuzzy Hash: 23ef701ab7b21fa014fab5ac25e25b663ed0b9eafcaf1a759c440074eedd608e
                                          • Instruction Fuzzy Hash: EB214A742442019FC750EB54DC81EAA77E9EB48350F4484A4F9A9C7320E779F9159B12
                                          Function 0466E740 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 0466E7B8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QState$connectNotify$connectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-1963487350
                                          • Opcode ID: 364f038192e6eb00009e8e93c95166892e0250d44e8a1d508a03a4c3dd660399
                                          • Instruction ID: 1b252b70d5f1ca43acf27f97236b25f0abb3b89e65ec970f9ef1d54e753e19ae
                                          • Opcode Fuzzy Hash: 364f038192e6eb00009e8e93c95166892e0250d44e8a1d508a03a4c3dd660399
                                          • Instruction Fuzzy Hash: 05215CB82443029FC700DB54D981EA63BE9FB58714F544864F85AC7320E77AFA19DF12
                                          Function 04698710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04698788
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ8$QTranslator$timerEvent$timerEvent(self, a0: Optional[QTimerEvent])
                                          • API String ID: 12784630-1808985007
                                          • Opcode ID: 02c2c34edd14be2b7f7dd45bef5179e641d43b833420b7691f7c56378aa17056
                                          • Instruction ID: 23c2cd8ad528db4905c991c89d893b4616c77688716193aef94bde4c8cbfeb41
                                          • Opcode Fuzzy Hash: 02c2c34edd14be2b7f7dd45bef5179e641d43b833420b7691f7c56378aa17056
                                          • Instruction Fuzzy Hash: 49214A742442019FCB00EF55EC85EAA37E9EB49350F444869F858CB320E7BAED59DB12
                                          Function 046607E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 04660858
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: BJ9$QPauseAnimation$disconnectNotify$disconnectNotify(self, signal: QMetaMethod)
                                          • API String ID: 12784630-2718208113
                                          • Opcode ID: dfed5200dd118cb98d5e8963c65456f6e13b7b673e2720be45836d69d5b058d8
                                          • Instruction ID: edf25014b48bd5e320bf52ef802ff68cf3824ac73e70c98883e209063bf49057
                                          • Opcode Fuzzy Hash: dfed5200dd118cb98d5e8963c65456f6e13b7b673e2720be45836d69d5b058d8
                                          • Instruction Fuzzy Hash: 6C213D74248302AFCB04DB54E881EAA77E9FB98310F448478F85AC7320E779F915DB92
                                          Function 046AA560 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?fromString@QVersionNumber@@SA?AV1@ABVQString@@PAH@Z.QT5CORE(00000000,?,?,00000004), ref: 046AA5C1
                                          Strings
                                          • (Ri), xrefs: 046AA5FF
                                          • fromString, xrefs: 046AA61D
                                          • fromString(string: Optional[str]) -> (QVersionNumber, Optional[int]), xrefs: 046AA618
                                          • QVersionNumber, xrefs: 046AA622
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?fromNumber@@String@String@@Versionmalloc
                                          • String ID: (Ri)$QVersionNumber$fromString$fromString(string: Optional[str]) -> (QVersionNumber, Optional[int])
                                          • API String ID: 802829302-138771285
                                          • Opcode ID: 8f4276e4d71fbd33848180889a1d6d4179ef435a393873108a21c8bb5489d16c
                                          • Instruction ID: 98161bc686b3476824275b36a3f0bee97fbbc3915fbd3fc771b1e3730339acef
                                          • Opcode Fuzzy Hash: 8f4276e4d71fbd33848180889a1d6d4179ef435a393873108a21c8bb5489d16c
                                          • Instruction Fuzzy Hash: 7C216D71244201BFD741EF94DC41FAA7BE5FB48710F444858FA5497360D6BAAD14DF22
                                          Function 046BC430 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 63COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?constData@QByteArray@@QBEPBDXZ.QT5CORE(?,?), ref: 046BC4A6
                                          • ?qCompress@@YA?AVQByteArray@@PBEHH@Z.QT5CORE(00000000,00000000), ref: 046BC4AE
                                          Strings
                                          • qCompress(data: Union[QByteArray, bytes, bytearray], compressionLevel: int = -1) -> QByteArray, xrefs: 046BC4EC
                                          • J1|i, xrefs: 046BC463
                                          • qCompress, xrefs: 046BC4F1
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Array@@Byte$?constCompress@@Data@malloc
                                          • String ID: J1|i$qCompress$qCompress(data: Union[QByteArray, bytes, bytearray], compressionLevel: int = -1) -> QByteArray
                                          • API String ID: 1153347472-3302120302
                                          • Opcode ID: cff6c548151cfc9d70ee3fc6e3941928e4b46b238372f67a98ca2c887ffaec54
                                          • Instruction ID: 0cd1a2ff886d17c4b1ca3e580a999ed2e080a0a62ba037ae5297e6f378e115dd
                                          • Opcode Fuzzy Hash: cff6c548151cfc9d70ee3fc6e3941928e4b46b238372f67a98ca2c887ffaec54
                                          • Instruction Fuzzy Hash: D9219AB1104301AFD740DF84CC40F9A7BE9FB88310F448958F969D6360D779AA649F92
                                          Function 0466C5E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z.QT5CORE(?), ref: 0466C65D
                                          Strings
                                          • setPath(self, path: Optional[str], mode: QUrl.ParsingMode = QUrl.DecodedMode), xrefs: 0466C6A1
                                          • QUrl, xrefs: 0466C6AB
                                          • setPath, xrefs: 0466C6A6
                                          • BJ1|E, xrefs: 0466C625
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setMode@1@@ParsingPath@String@@Url@@
                                          • String ID: BJ1|E$QUrl$setPath$setPath(self, path: Optional[str], mode: QUrl.ParsingMode = QUrl.DecodedMode)
                                          • API String ID: 3989100379-275061979
                                          • Opcode ID: 227071434e89a41ac76276ef4cd93943173160240ae2a4789ee07a7c4f2ba289
                                          • Instruction ID: e6e24c24e8344d656abd4b0ac6ba44807fe13612869a6be1323aa0c88b0018f1
                                          • Opcode Fuzzy Hash: 227071434e89a41ac76276ef4cd93943173160240ae2a4789ee07a7c4f2ba289
                                          • Instruction Fuzzy Hash: C6213AB0204301AFC701DF54DC41E9A7BF9FB88714F848968F9A9C6220D37AE9259F12
                                          Function 046F6440 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?name@QMetaEnum@@QBEPBDXZ.QT5CORE ref: 046F6480
                                          • PyUnicode_DecodeASCII.PYTHON3(00000000,00000001,00000000), ref: 046F64BD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?name@DecodeEnum@@MetaUnicode_
                                          • String ID: QMetaEnum$name$name(self) -> Optional[str]
                                          • API String ID: 3429399224-4052822529
                                          • Opcode ID: c7fb406f623f43c1d0ab9d57c55ddc9a6b64c3c4cbeb75d64de7e29fe9472909
                                          • Instruction ID: 03f1d5f7a804aeb54df099fa1d7c2ca537df71d38bea43ae7423bfc659dd0f76
                                          • Opcode Fuzzy Hash: c7fb406f623f43c1d0ab9d57c55ddc9a6b64c3c4cbeb75d64de7e29fe9472909
                                          • Instruction Fuzzy Hash: 48119E74200201AFCB04EF28EC45EAA37E9FB84714F448868E899D7351E679AD1BCB51
                                          Function 046EE410 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?value@QMetaClassInfo@@QBEPBDXZ.QT5CORE ref: 046EE450
                                          • PyUnicode_DecodeASCII.PYTHON3(00000000,00000001,00000000), ref: 046EE48D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?value@ClassDecodeInfo@@MetaUnicode_
                                          • String ID: QMetaClassInfo$value$value(self) -> Optional[str]
                                          • API String ID: 1074395309-3309325056
                                          • Opcode ID: 9f0a735492899b051af2620fca7b6e1a6f89f263503835d3eb59b50445f1cd9f
                                          • Instruction ID: 08cae6db257fc6f3986ccc0011db906e579b2d3b8386eb4978d6648bb7f007da
                                          • Opcode Fuzzy Hash: 9f0a735492899b051af2620fca7b6e1a6f89f263503835d3eb59b50445f1cd9f
                                          • Instruction Fuzzy Hash: 3711CE742002019FCB00EF28EC51EBA37E9FB88714F448568F889D7350E67AAE16CB52
                                          Function 046E04A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?data@QMimeData@@QBE?AVQByteArray@@ABVQString@@@Z.QT5CORE(00000000,?), ref: 046E0508
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?data@Array@@ByteData@@MimeString@@@malloc
                                          • String ID: BJ1$QMimeData$data$data(self, mimetype: Optional[str]) -> QByteArray
                                          • API String ID: 4086308724-2050873524
                                          • Opcode ID: f71738bedb19c8ff6b681a6b6bda7270c6be66dbdb5b24b637f70e2ba32867c5
                                          • Instruction ID: af6135d4c278372ae78c5096083c68245f11623b96f67e5ac36988a97b2e0bfc
                                          • Opcode Fuzzy Hash: f71738bedb19c8ff6b681a6b6bda7270c6be66dbdb5b24b637f70e2ba32867c5
                                          • Instruction Fuzzy Hash: C011BEB0144201BFDB00EB54DC40EEA7BE9FB88314F444858F95887320D7B9EE259B62
                                          Function 046A0560 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?filePath@QTemporaryDir@@QBE?AVQString@@ABV2@@Z.QT5CORE(00000000,?), ref: 046A05C8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?fileDir@@Path@String@@TemporaryV2@@malloc
                                          • String ID: BJ1$QTemporaryDir$filePath$filePath(self, fileName: Optional[str]) -> str
                                          • API String ID: 688581552-2387282947
                                          • Opcode ID: 87f80f0caba22f1aba5f9799a1f9176c513a7a59a73f831fd92fd98c43450bcc
                                          • Instruction ID: f92da698786717d2a8d003140bea4d2eb19c21e23d66054a38c46b9066f78ea9
                                          • Opcode Fuzzy Hash: 87f80f0caba22f1aba5f9799a1f9176c513a7a59a73f831fd92fd98c43450bcc
                                          • Instruction Fuzzy Hash: 1211ACB0148201AFDB01EF54DC41EEA7BE9FB88314F444858F99897320D2BAED649B62
                                          Function 04684540 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?fromUnicode@QTextCodec@@QBE?AVQByteArray@@ABVQString@@@Z.QT5CORE(00000000,?), ref: 046845A8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?fromArray@@ByteCodec@@String@@@TextUnicode@malloc
                                          • String ID: BJ1$QTextCodec$fromUnicode$fromUnicode(self, uc: Optional[str]) -> QByteArray
                                          • API String ID: 3080012236-3203745266
                                          • Opcode ID: 13c61104ba493dca203bc0d0c4e83eb94d196a2f9b715a064d56681024681e0c
                                          • Instruction ID: be1857e60c81d49df83ec51aa9380e9606b345dcb182af7edbea7c5e19c61c4f
                                          • Opcode Fuzzy Hash: 13c61104ba493dca203bc0d0c4e83eb94d196a2f9b715a064d56681024681e0c
                                          • Instruction Fuzzy Hash: 491190B0104202AFD701EF54DC41EEA7BEAFB88314F444858F95897320E779ED65DB62
                                          Function 046FC530 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?typeName@QMetaMethod@@QBEPBDXZ.QT5CORE ref: 046FC570
                                          • PyUnicode_DecodeASCII.PYTHON3(00000000,00000001,00000000), ref: 046FC5AD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?typeDecodeMetaMethod@@Name@Unicode_
                                          • String ID: QMetaMethod$typeName$typeName(self) -> Optional[str]
                                          • API String ID: 505737282-2421348583
                                          • Opcode ID: 509c9c04f994c4d67a916be04ca00ab7f5b3718be9499209dcb87cc182053ee5
                                          • Instruction ID: 06c01e8bd9c024134dffa78ca1cb6ec5b1f63f71b045bbfa5a2cb457401465b5
                                          • Opcode Fuzzy Hash: 509c9c04f994c4d67a916be04ca00ab7f5b3718be9499209dcb87cc182053ee5
                                          • Instruction Fuzzy Hash: C811E3B46002019FDB14DF14EC41EA637E9FB84700F448468F899C7310E679FD1ACB51
                                          Function 046CA510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?size@QBitArray@@QBEHXZ.QT5CORE ref: 046CA570
                                          • ??BQBitRef@@QBE_NXZ.QT5CORE ref: 046CA594
                                          • PyBool_FromLong.PYTHON3(?), ref: 046CA59E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?size@Array@@Bool_FromLongRef@@
                                          • String ID: QBitArray$__getitem__
                                          • API String ID: 1381810832-1078208757
                                          • Opcode ID: e74b3dfdf9da33147b9f3cebeb334d6b0851f1399feacdff8be77f9cc78cd172
                                          • Instruction ID: 49b479123055fe54acc3aa08bc44706bc7b7c5050fc38b648e15474b13f65967
                                          • Opcode Fuzzy Hash: e74b3dfdf9da33147b9f3cebeb334d6b0851f1399feacdff8be77f9cc78cd172
                                          • Instruction Fuzzy Hash: C7115E716043019FD710EFA8DC45EAA77E5FB88310F848869F869C3310E779E9159B52
                                          Function 046A65F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?previousTransition@QTimeZone@@QBE?AUOffsetData@1@ABVQDateTime@@@Z.QT5CORE(00000000,?), ref: 046A6658
                                          Strings
                                          • previousTransition, xrefs: 046A669E
                                          • BJ1, xrefs: 046A6622
                                          • previousTransition(self, beforeDateTime: Union[QDateTime, datetime.datetime]) -> QTimeZone.OffsetData, xrefs: 046A6699
                                          • QTimeZone, xrefs: 046A66A3
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?previousData@1@DateOffsetTimeTime@@@Transition@Zone@@malloc
                                          • String ID: BJ1$QTimeZone$previousTransition$previousTransition(self, beforeDateTime: Union[QDateTime, datetime.datetime]) -> QTimeZone.OffsetData
                                          • API String ID: 2941705803-3834947685
                                          • Opcode ID: bb31e95c531afdee95bd34f0a5dcb9919460539644240de783a228cd3733737b
                                          • Instruction ID: 63048b8cd056fd4110017742ebd0a6f3fd876930c5654f30e2d068fd2402f63f
                                          • Opcode Fuzzy Hash: bb31e95c531afdee95bd34f0a5dcb9919460539644240de783a228cd3733737b
                                          • Instruction Fuzzy Hash: 2811BEB0204201AFD701EF54DC40EDA7BE9FB88714F444858F95997320E37AEE549B52
                                          Function 046C65A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?mimeTypesForFileName@QMimeDatabase@@QBE?AV?$QList@VQMimeType@@@@ABVQString@@@Z.QT5CORE(00000000,?), ref: 046C6608
                                          Strings
                                          • mimeTypesForFileName, xrefs: 046C664E
                                          • BJ1, xrefs: 046C65D2
                                          • mimeTypesForFileName(self, fileName: Optional[str]) -> List[QMimeType], xrefs: 046C6649
                                          • QMimeDatabase, xrefs: 046C6653
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Mime$?mimeDatabase@@FileList@Name@String@@@Type@@@@Typesmalloc
                                          • String ID: BJ1$QMimeDatabase$mimeTypesForFileName$mimeTypesForFileName(self, fileName: Optional[str]) -> List[QMimeType]
                                          • API String ID: 3768187349-572002605
                                          • Opcode ID: a17cfcffcf194ee4077dce60d8a2c89d36b928361b431e6f96a2a252c25c0273
                                          • Instruction ID: 0822f717a3e7567f93d89f505e0123318002acd12051015fd8b4d718527dce21
                                          • Opcode Fuzzy Hash: a17cfcffcf194ee4077dce60d8a2c89d36b928361b431e6f96a2a252c25c0273
                                          • Instruction Fuzzy Hash: BF11ACB0104202AFD700EB54DC41EEA7BE9FB88314F448818F95987320D2B9ED54DBA2
                                          Function 046EC4A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?weekDayName@QCalendar@@QBE?AVQString@@ABVQLocale@@HW4FormatType@3@@Z.QT5CORE(00000000,?,?), ref: 046EC524
                                          Strings
                                          • QCalendar, xrefs: 046EC553
                                          • weekDayName(self, locale: QLocale, day: int, format: QLocale.FormatType = QLocale.LongFormat) -> str, xrefs: 046EC549
                                          • weekDayName, xrefs: 046EC54E
                                          • BJ9i|E, xrefs: 046EC4DD
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?weekCalendar@@FormatLocale@@Name@String@@Type@3@@malloc
                                          • String ID: BJ9i|E$QCalendar$weekDayName$weekDayName(self, locale: QLocale, day: int, format: QLocale.FormatType = QLocale.LongFormat) -> str
                                          • API String ID: 205945374-326494565
                                          • Opcode ID: f30195dbf3c59fc06ebeafc8695103c03cb993e78343057bcd343862d28cc101
                                          • Instruction ID: f3021d2907fb74ea8681e784e914b76b30d06b4cb81a3e72eb28099b6d209710
                                          • Opcode Fuzzy Hash: f30195dbf3c59fc06ebeafc8695103c03cb993e78343057bcd343862d28cc101
                                          • Instruction Fuzzy Hash: E2117CB1144202AFDB01DF94DC41F9A77F9FB88704F444828FA5592220D3B9EA299B22
                                          Function 0464A560 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?encodeData@QAbstractItemModel@@IBEXABV?$QList@VQModelIndex@@@@AAVQDataStream@@@Z.QT5CORE(?,?), ref: 0464A5CC
                                          Strings
                                          • BJ1J9, xrefs: 0464A59E
                                          • encodeData, xrefs: 0464A614
                                          • encodeData(self, indexes: Iterable[QModelIndex], stream: QDataStream), xrefs: 0464A60F
                                          • QStringListModel, xrefs: 0464A619
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?encodeAbstractDataData@Index@@@@ItemList@ModelModel@@Stream@@@
                                          • String ID: BJ1J9$QStringListModel$encodeData$encodeData(self, indexes: Iterable[QModelIndex], stream: QDataStream)
                                          • API String ID: 923366031-641422507
                                          • Opcode ID: 5f9d5e555510c598a3f10d2ddd687a0ec8edf3c67100629553cad25007c621e4
                                          • Instruction ID: 6af5a05a9402584dd165037de9f350e1bab543c907feeace008b38baabd71998
                                          • Opcode Fuzzy Hash: 5f9d5e555510c598a3f10d2ddd687a0ec8edf3c67100629553cad25007c621e4
                                          • Instruction Fuzzy Hash: EC212C71248201AFC701DF54DC80EAA7BEAFB88314F448969F959C7321D37AE955DF12
                                          Function 046FA740 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?encodeData@QAbstractItemModel@@IBEXABV?$QList@VQModelIndex@@@@AAVQDataStream@@@Z.QT5CORE(?,?), ref: 046FA7AC
                                          Strings
                                          • BJ1J9, xrefs: 046FA77E
                                          • encodeData, xrefs: 046FA7F4
                                          • encodeData(self, indexes: Iterable[QModelIndex], stream: QDataStream), xrefs: 046FA7EF
                                          • QConcatenateTablesProxyModel, xrefs: 046FA7F9
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?encodeAbstractDataData@Index@@@@ItemList@ModelModel@@Stream@@@
                                          • String ID: BJ1J9$QConcatenateTablesProxyModel$encodeData$encodeData(self, indexes: Iterable[QModelIndex], stream: QDataStream)
                                          • API String ID: 923366031-3339606736
                                          • Opcode ID: 2f009830240b9aea5324cded2ade98c7708bb710943e37c6c4a6eca799cbc3b4
                                          • Instruction ID: ec6a2a924319e043b8eddc1cd4c582b6cfb8f677a7c9205b462deaa4f498a6ed
                                          • Opcode Fuzzy Hash: 2f009830240b9aea5324cded2ade98c7708bb710943e37c6c4a6eca799cbc3b4
                                          • Instruction Fuzzy Hash: 9B211A71114202AFC701DF54DC80EAA7BFAFB88314F448869F959C3221D37AED15DB12
                                          Function 046CE440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setSorting@QDir@@QAEXV?$QFlags@W4SortFlag@QDir@@@@@Z.QT5CORE(?), ref: 046CE49E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setDir@@Dir@@@@@Flag@Flags@SortSorting@
                                          • String ID: BJ1$QDir$setSorting$setSorting(self, sort: Union[QDir.SortFlags, QDir.SortFlag])
                                          • API String ID: 453259556-1550241236
                                          • Opcode ID: 303d931c5b3444177d206df74c2d2dc33b6b838f2480f1cfd4ee1e88d9081ab3
                                          • Instruction ID: 71031c01dfa49e5494c15efd05d4b22e21cd33f28b47d9d80f0394f48bf5ed71
                                          • Opcode Fuzzy Hash: 303d931c5b3444177d206df74c2d2dc33b6b838f2480f1cfd4ee1e88d9081ab3
                                          • Instruction Fuzzy Hash: 8F114C74204201AFD701DB58DC80EA97BF9FB88314F848969F559C3321E67AEE25DB02
                                          Function 046F2400 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setNumberOptions@QLocale@@QAEXV?$QFlags@W4NumberOption@QLocale@@@@@Z.QT5CORE(?), ref: 046F245E
                                          Strings
                                          • setNumberOptions, xrefs: 046F24A6
                                          • setNumberOptions(self, options: Union[QLocale.NumberOptions, QLocale.NumberOption]), xrefs: 046F24A1
                                          • QLocale, xrefs: 046F24AB
                                          • BJ1, xrefs: 046F2432
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Number$?setFlags@Locale@@Locale@@@@@Option@Options@
                                          • String ID: BJ1$QLocale$setNumberOptions$setNumberOptions(self, options: Union[QLocale.NumberOptions, QLocale.NumberOption])
                                          • API String ID: 2582221833-3930121158
                                          • Opcode ID: 6013e7c484f019f5bd4d9f0347c7ade4678ee4fcfeac6e36046b5983cef85af0
                                          • Instruction ID: 6d3878aef5c8a8edfe7e754971b07cfbe0b0948e3049daf9e018f1dc866b7d04
                                          • Opcode Fuzzy Hash: 6013e7c484f019f5bd4d9f0347c7ade4678ee4fcfeac6e36046b5983cef85af0
                                          • Instruction Fuzzy Hash: 60114C70204201AFD701DB58DD80EA97BE9FB88314F448968F5A9C7321D27AED259F02
                                          Function 046DC560 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setUrls@QMimeData@@QAEXABV?$QList@VQUrl@@@@@Z.QT5CORE(?), ref: 046DC5BC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setData@@List@MimeUrl@@@@@Urls@
                                          • String ID: BJ1$QMimeData$setUrls$setUrls(self, urls: Iterable[QUrl])
                                          • API String ID: 2395860826-4164736999
                                          • Opcode ID: dbb141101edd1bd9732f02aef1fe2cfd9fe3df0ceedfe10a7a0fc4ec0b544384
                                          • Instruction ID: a2b1ab10a4686597d4f52af4ba5d49a301c48f5c2451915445ba4b90e26b54b3
                                          • Opcode Fuzzy Hash: dbb141101edd1bd9732f02aef1fe2cfd9fe3df0ceedfe10a7a0fc4ec0b544384
                                          • Instruction Fuzzy Hash: 9E116D70204205AFD701DF58DD40E9A7BE9FB88310F848968F859C3320D77AEE65DB02
                                          Function 0467E510 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?remove@QProcessEnvironment@@QAEXABVQString@@@Z.QT5CORE(?), ref: 0467E56C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?remove@Environment@@ProcessString@@@
                                          • String ID: BJ1$QProcessEnvironment$remove$remove(self, name: Optional[str])
                                          • API String ID: 257053633-2169925166
                                          • Opcode ID: d619af6e486b8a5e882e97e1b67c940166e3edf23b4740b6b5297655eea8f46c
                                          • Instruction ID: cd80fcad5677bbf0d7b0a34f72d044379602fbe0c4b3f005ca3ffcec2f8e193c
                                          • Opcode Fuzzy Hash: d619af6e486b8a5e882e97e1b67c940166e3edf23b4740b6b5297655eea8f46c
                                          • Instruction Fuzzy Hash: 62115E70204205AFD701DF58DC40EAA7BF9FB88314F448968F859C7320E37AED659B12
                                          Function 0469C5F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setFileTemplate@QTemporaryFile@@QAEXABVQString@@@Z.QT5CORE(?), ref: 0469C64C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setFileFile@@String@@@Template@Temporary
                                          • String ID: BJ1$QTemporaryFile$setFileTemplate$setFileTemplate(self, name: Optional[str])
                                          • API String ID: 2802065688-2730024127
                                          • Opcode ID: d1fe001557c9be9d93bd793f75af575033f1bde484782c641175fbe4895b3f6b
                                          • Instruction ID: 00ec72f954e5e3489e23308599efb000a07435be4bdca497d1bab7b3fdc8016c
                                          • Opcode Fuzzy Hash: d1fe001557c9be9d93bd793f75af575033f1bde484782c641175fbe4895b3f6b
                                          • Instruction Fuzzy Hash: EB112E70204201AFC741DF58DC41EA97BE9FB88314F848968F859D7320D379ED65DB12
                                          Function 04682580 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?writeEntityReference@QXmlStreamWriter@@QAEXABVQString@@@Z.QT5CORE(?), ref: 046825DC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?writeEntityReference@StreamString@@@Writer@@
                                          • String ID: BJ1$QXmlStreamWriter$writeEntityReference$writeEntityReference(self, name: Optional[str])
                                          • API String ID: 2742126905-906045880
                                          • Opcode ID: d271ff8bee75341dbc9012a17000cd5e2a12ccc4ecfe1877511612057a2b25ad
                                          • Instruction ID: 24e87d224dc579ec239b40b464fe01ba35bbf652ce537ff1e058cae4f028df5b
                                          • Opcode Fuzzy Hash: d271ff8bee75341dbc9012a17000cd5e2a12ccc4ecfe1877511612057a2b25ad
                                          • Instruction Fuzzy Hash: 41116D70204201AFC701DF58DC81EAA7BE9FB88314F448968F9A9C7321E379ED65DB12
                                          Function 04670630 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginGroup@QSettings@@QAEXABVQString@@@Z.QT5CORE(?), ref: 0467068C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginGroup@Settings@@String@@@
                                          • String ID: BJ1$QSettings$beginGroup$beginGroup(self, prefix: Optional[str])
                                          • API String ID: 2031875892-3752053108
                                          • Opcode ID: 72abd497a984222a9bcc780d4f94a50c96a1b3cb88c843fbbbb2e509f15ce252
                                          • Instruction ID: c2824b5bd947bddfe9086f68c788e457097933f04eb2a08d5fade53d990f14a1
                                          • Opcode Fuzzy Hash: 72abd497a984222a9bcc780d4f94a50c96a1b3cb88c843fbbbb2e509f15ce252
                                          • Instruction Fuzzy Hash: 76111C70204201AFC741DF58DC81E9A7BE9FB88314F448A68F959D7360D379E9259B12
                                          Function 0468C550 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setEntityResolver@QXmlStreamReader@@QAEXPAVQXmlStreamEntityResolver@@@Z.QT5CORE(?), ref: 0468C5A4
                                          Strings
                                          • B@J8, xrefs: 0468C57A
                                          • QXmlStreamReader, xrefs: 0468C5F1
                                          • setEntityResolver, xrefs: 0468C5EC
                                          • setEntityResolver(self, resolver: Optional[QXmlStreamEntityResolver]), xrefs: 0468C5E7
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: EntityStream$?setReader@@Resolver@Resolver@@@
                                          • String ID: B@J8$QXmlStreamReader$setEntityResolver$setEntityResolver(self, resolver: Optional[QXmlStreamEntityResolver])
                                          • API String ID: 1203928266-3835866093
                                          • Opcode ID: 7480abc3318d35dadeccc048efbe4bf2d8a8cdfdc718c8cd4771ea9efc271183
                                          • Instruction ID: f34272127baa1af6ac48102d0f280dbc2918e403496608ea08a8933c164af293
                                          • Opcode Fuzzy Hash: 7480abc3318d35dadeccc048efbe4bf2d8a8cdfdc718c8cd4771ea9efc271183
                                          • Instruction Fuzzy Hash: BF118F70204201AFCB01DF58DD81DAA77E9FB88310F848A68F868C7360D779ED259F12
                                          Function 04710620 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setEventSource@QEventTransition@@QAEXPAVQObject@@@Z.QT5CORE(?), ref: 04710674
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Event$?setObject@@@Source@Transition@@
                                          • String ID: B@J8$QEventTransition$setEventSource$setEventSource(self, object: Optional[QObject])
                                          • API String ID: 1107068109-4267592728
                                          • Opcode ID: 6044614eaee7b779208f6314980008d15945bbd8c1e55044bb6efc0ba9d67eb3
                                          • Instruction ID: 416e212f38873e4639b7af7cac8ba3799dce078b5858a5efcc1585395f9c378a
                                          • Opcode Fuzzy Hash: 6044614eaee7b779208f6314980008d15945bbd8c1e55044bb6efc0ba9d67eb3
                                          • Instruction Fuzzy Hash: 45118CB0244201AFD701DB58DD81DAA73E9FB8C310F448969F869D3320D379EE15DB02
                                          Function 046E64D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setDeadline@QDeadlineTimer@@QAEX_JW4TimerType@Qt@@@Z.QT5CORE(?,?), ref: 046E653E
                                          Strings
                                          • setDeadline, xrefs: 046E656C
                                          • QDeadlineTimer, xrefs: 046E6571
                                          • setDeadline(self, msecs: int, type: Qt.TimerType = Qt.CoarseTimer), xrefs: 046E6567
                                          • Bn|E, xrefs: 046E6502
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setDeadlineDeadline@Qt@@@TimerTimer@@Type@
                                          • String ID: Bn|E$QDeadlineTimer$setDeadline$setDeadline(self, msecs: int, type: Qt.TimerType = Qt.CoarseTimer)
                                          • API String ID: 3616201917-912088926
                                          • Opcode ID: 71501db6f03664c01d53af6eb07d2046cb98509fb0544e41aa2b1a495359824a
                                          • Instruction ID: 2ae6216a80d3bc919bf659c11db8936299e727fae0552ed617354e2970c33177
                                          • Opcode Fuzzy Hash: 71501db6f03664c01d53af6eb07d2046cb98509fb0544e41aa2b1a495359824a
                                          • Instruction Fuzzy Hash: 4A118BB4244301AFC701DF64DD41E9A77E9FB88700F808968F955D6360E37AED19DB12
                                          Function 046CC620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?cd@QDir@@QAE_NABVQString@@@Z.QT5CORE(?), ref: 046CC67D
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046CC6A2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?cd@Bool_Dir@@FromLongString@@@
                                          • String ID: BJ1$QDir$cd(self, dirName: Optional[str]) -> bool
                                          • API String ID: 2249938621-919006550
                                          • Opcode ID: d55edf2e97a178b36f32a0a466105e4383f0d784e7cdd2dcd8cf85dbf9225b38
                                          • Instruction ID: 36bb5c3e279a398dcaf9d56f52915b03f840b2ebbaaaaccd74127eb3ca4f852d
                                          • Opcode Fuzzy Hash: d55edf2e97a178b36f32a0a466105e4383f0d784e7cdd2dcd8cf85dbf9225b38
                                          • Instruction Fuzzy Hash: A51170B0148201AFDB01EF54DC45EAA7BE9FB88314F448858F99983321D779ED65DB22
                                          Function 046AA6C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?grownBy@QSizeF@@QBE?AV1@VQMarginsF@@@Z.QT5CORE(00000000), ref: 046AA72A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?grownF@@@MarginsSizemalloc
                                          • String ID: BJ9$QSizeF$grownBy$grownBy(self, m: QMarginsF) -> QSizeF
                                          • API String ID: 1523560087-4282387611
                                          • Opcode ID: 9c1bd57cd069d14aadfc4cd9f945be3bc89ec3a5603952c8b3da252dc7513a41
                                          • Instruction ID: 4922f9db7289f7b05c2a28de775b1cd10963ef10f001811f0a8295c51a12add4
                                          • Opcode Fuzzy Hash: 9c1bd57cd069d14aadfc4cd9f945be3bc89ec3a5603952c8b3da252dc7513a41
                                          • Instruction Fuzzy Hash: 261194B0644301AFD701DF68DC41EA973E5FB88304F048568F958D6211E7B5EA99CB51
                                          Function 0470A6D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginRemoveRows@QAbstractItemModel@@IAEXABVQModelIndex@@HH@Z.QT5CORE(?,?,?), ref: 0470A731
                                          Strings
                                          • BJ9ii, xrefs: 0470A6FF
                                          • QIdentityProxyModel, xrefs: 0470A764
                                          • beginRemoveRows(self, parent: QModelIndex, first: int, last: int), xrefs: 0470A75A
                                          • beginRemoveRows, xrefs: 0470A75F
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginAbstractIndex@@ItemModelModel@@RemoveRows@
                                          • String ID: BJ9ii$QIdentityProxyModel$beginRemoveRows$beginRemoveRows(self, parent: QModelIndex, first: int, last: int)
                                          • API String ID: 2178905876-1158828350
                                          • Opcode ID: 6a1dffa68fea3d695d6e4d104f9c2fb845bce60d4f1885f8fd3aa15660ac2263
                                          • Instruction ID: f202afa6e3497a6d541ece12aedd4a7d9163aba1c5bd002332a216dac9d89b9f
                                          • Opcode Fuzzy Hash: 6a1dffa68fea3d695d6e4d104f9c2fb845bce60d4f1885f8fd3aa15660ac2263
                                          • Instruction Fuzzy Hash: 40119AB0204201AFC701DF64DD40DAAB7F9FB88710F448969F899D3360E679EE16DB12
                                          Function 047087F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?data@QPersistentModelIndex@@QBE?AVQVariant@@H@Z.QT5CORE(00000000), ref: 04708856
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?data@Index@@ModelPersistentVariant@@malloc
                                          • String ID: B|i$QPersistentModelIndex$data$data(self, role: int = Qt.ItemDataRole.DisplayRole) -> Any
                                          • API String ID: 2120325009-3160945248
                                          • Opcode ID: a8cbae59b6e9e35afdcac4ee3782cc770c3bf95842fd9aa7626c240580b13c87
                                          • Instruction ID: b500c364c75f453d8d07272fe39f276c1f4510a3537b62a6084450a6c5324cf1
                                          • Opcode Fuzzy Hash: a8cbae59b6e9e35afdcac4ee3782cc770c3bf95842fd9aa7626c240580b13c87
                                          • Instruction Fuzzy Hash: 9B118BB0644301AFD710EB94EC42F9A73E9FB88700F448828F958D7350E3B9EA19DB52
                                          Function 0464C690 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?changePersistentIndex@QAbstractItemModel@@IAEXABVQModelIndex@@0@Z.QT5CORE(?,?), ref: 0464C6E9
                                          Strings
                                          • BJ9J9, xrefs: 0464C6BB
                                          • changePersistentIndex, xrefs: 0464C717
                                          • changePersistentIndex(self, from_: QModelIndex, to: QModelIndex), xrefs: 0464C712
                                          • QStringListModel, xrefs: 0464C71C
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?changeAbstractIndex@Index@@0@ItemModelModel@@Persistent
                                          • String ID: BJ9J9$QStringListModel$changePersistentIndex$changePersistentIndex(self, from_: QModelIndex, to: QModelIndex)
                                          • API String ID: 794346470-1345576863
                                          • Opcode ID: 808a775080e6ba0e4859cb30c23fe29713898651a3fb3d80242a8d158e1886ae
                                          • Instruction ID: 6f6bf6a56e7203b12b0bde8f5fbc82eb049fbaa5ba71e68a07a5f6fb4f5857d8
                                          • Opcode Fuzzy Hash: 808a775080e6ba0e4859cb30c23fe29713898651a3fb3d80242a8d158e1886ae
                                          • Instruction Fuzzy Hash: 4D115E74204201AFD740DB64DC81DAA73EAFB88314F448959F869D3320E779EE16CF12
                                          Function 046A86D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000001), ref: 046A872E
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046A873E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: QSizeF$isValid$isValid(self) -> bool
                                          • API String ID: 2610644205-1583398244
                                          • Opcode ID: a9aa96fe4d97d591a3444c98bb49eff255a1f3ba96400d000408e84f153e6082
                                          • Instruction ID: 7d0d02379f088a6c771105c098147ec12e376a64e50f7a313ad2fddc51f58e9f
                                          • Opcode Fuzzy Hash: a9aa96fe4d97d591a3444c98bb49eff255a1f3ba96400d000408e84f153e6082
                                          • Instruction Fuzzy Hash: AC0100B4504A05AFDB02EB74EC46E8A73E8FF50740F844960F809E7201F278EE298B52
                                          Function 046C8550 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setEnabled@QLoggingCategory@@QAEXW4QtMsgType@@_N@Z.QT5CORE(?,?), ref: 046C85A8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setCategory@@Enabled@LoggingType@@_
                                          • String ID: BEb$QLoggingCategory$setEnabled$setEnabled(self, type: QtMsgType, enable: bool)
                                          • API String ID: 2515865037-2745562245
                                          • Opcode ID: 6e48c22bb451847f5264893be8cce967314a0de22a9d6a8ad2ba8220e9ff7099
                                          • Instruction ID: 5a78a41fa05a4f012ae4538a76007a41c7fe94f4c82d835ce77f79560bf57d40
                                          • Opcode Fuzzy Hash: 6e48c22bb451847f5264893be8cce967314a0de22a9d6a8ad2ba8220e9ff7099
                                          • Instruction Fuzzy Hash: A2112774204205AFD740EB58DC81DAA77E9FB88310F848969F869C3261E779AE15DF02
                                          Function 04702620 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?mapFromSource@QConcatenateTablesProxyModel@@QBE?AVQModelIndex@@ABV2@@Z.QT5CORE(00000000,?), ref: 0470267A
                                          Strings
                                          • mapFromSource(self, sourceIndex: QModelIndex) -> QModelIndex, xrefs: 0470269F
                                          • mapFromSource, xrefs: 047026A4
                                          • BJ9, xrefs: 04702645
                                          • QConcatenateTablesProxyModel, xrefs: 047026A9
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?mapConcatenateFromIndex@@ModelModel@@ProxySource@TablesV2@@malloc
                                          • String ID: BJ9$QConcatenateTablesProxyModel$mapFromSource$mapFromSource(self, sourceIndex: QModelIndex) -> QModelIndex
                                          • API String ID: 335128006-1037134373
                                          • Opcode ID: 2fe6bbc7e3690fcb20ea470b21c33f7c0d21ad65209c5e8472f4af7a746442be
                                          • Instruction ID: fb15e7c0ae519f4c2487af895318e88a8ffbbc3b34863136331ce40d708f1cb4
                                          • Opcode Fuzzy Hash: 2fe6bbc7e3690fcb20ea470b21c33f7c0d21ad65209c5e8472f4af7a746442be
                                          • Instruction Fuzzy Hash: F70192B0544201EFDB01DB94EC41FAA73E9FB88310F048864F969D7320E2B9EE19DB52
                                          Function 0465C600 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?marginsRemoved@QRectF@@QBE?AV1@ABVQMarginsF@@@Z.QT5CORE(00000000,?), ref: 0465C65A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?marginsF@@@MarginsRectRemoved@malloc
                                          • String ID: BJ9$QRectF$marginsRemoved$marginsRemoved(self, margins: QMarginsF) -> QRectF
                                          • API String ID: 768508439-1063964382
                                          • Opcode ID: 65788ffdd449db8209857c97d457feb8df1a94bc5ec863b5fdf3e0688ad9e8e5
                                          • Instruction ID: d61f42977bf9db2b08163d8b87a8b764d764778b7704dd475c78dc00a01e207f
                                          • Opcode Fuzzy Hash: 65788ffdd449db8209857c97d457feb8df1a94bc5ec863b5fdf3e0688ad9e8e5
                                          • Instruction Fuzzy Hash: 1E0184B0644302AFD701DB94DC41FAA73E9FB48310F448824F969D3310E2B9EE19DB52
                                          Function 04700730 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?toTimeZone@QDateTime@@QBE?AV1@ABVQTimeZone@@@Z.QT5CORE(00000000,?), ref: 0470078A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Time$DateTime@@Zone@Zone@@@malloc
                                          • String ID: BJ9$QDateTime$toTimeZone$toTimeZone(self, toZone: QTimeZone) -> QDateTime
                                          • API String ID: 3884276743-338869765
                                          • Opcode ID: 12ab678290eb27b030f52ec69fe85c3fece8b859ed04b3f3669699a7952af045
                                          • Instruction ID: 292943bb38e2d87cd3c2cf25b5b280ea4970ba2bf9030b3c233103f40b5f9ff8
                                          • Opcode Fuzzy Hash: 12ab678290eb27b030f52ec69fe85c3fece8b859ed04b3f3669699a7952af045
                                          • Instruction Fuzzy Hash: 850144B0644201EFDB01DBA4EC45FAA77E9FB48710F448824F959D6310E3B9EE15DB52
                                          Function 046A8470 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046A84C3
                                          • PyBool_FromLong.PYTHON3(00000001), ref: 046A84D6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: QSizeF$isEmpty$isEmpty(self) -> bool
                                          • API String ID: 2610644205-3852004453
                                          • Opcode ID: 35a5203c4bc4b65460172dfdf360f1f8bec4b34528f765b1ffd53f8aee24c12f
                                          • Instruction ID: 05f30c795fa7e7333686d78a5b435ceda3694ce4d15a9c47dd7ba2306d5b63a1
                                          • Opcode Fuzzy Hash: 35a5203c4bc4b65460172dfdf360f1f8bec4b34528f765b1ffd53f8aee24c12f
                                          • Instruction Fuzzy Hash: 23019EB1904205AFDB01EB64ED41E9A77E8FB54700F494974F809E3211F279EE68CF52
                                          Function 04676420 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?unlock@QReadLocker@@QAEXXZ.QT5CORE ref: 0467646F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?unlock@Locker@@Read
                                          • String ID: BP0P0P0$QWriteLocker$__exit__$__exit__(self, type: Any, value: Any, traceback: Any)
                                          • API String ID: 4068085240-2547708484
                                          • Opcode ID: ba629a7fca6c7eeddb7a80072ff000117625bd08231ab51860d27337b13c0777
                                          • Instruction ID: 9c647c0c532f643e2142c805456ed7ddcb7c883b387f4547210a751bb06bcc9b
                                          • Opcode Fuzzy Hash: ba629a7fca6c7eeddb7a80072ff000117625bd08231ab51860d27337b13c0777
                                          • Instruction Fuzzy Hash: F801ADB0244301AFC700DF54CC41DAA73E8FB88320F844969F85AC7320E779E9598F42
                                          Function 04650540 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setFrameRange@QTimeLine@@QAEXHH@Z.QT5CORE(?,?), ref: 04650592
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setFrameLine@@Range@Time
                                          • String ID: Bii$QTimeLine$setFrameRange$setFrameRange(self, startFrame: int, endFrame: int)
                                          • API String ID: 2210424958-1366436188
                                          • Opcode ID: 130aee5014587ee46b16388a200a56115bcec3d2c0cdaaa1aa4a101949473543
                                          • Instruction ID: e0f2e0a35f59624843efa4021a99af89a5a7aa2fe16899e5d6e3076fb38ce108
                                          • Opcode Fuzzy Hash: 130aee5014587ee46b16388a200a56115bcec3d2c0cdaaa1aa4a101949473543
                                          • Instruction Fuzzy Hash: 990157B4204301AFD701EF58DD81DAA73E9FB88310F948969F8A9C7320E779ED158B42
                                          Function 046E2660 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z.QT5CORE(?), ref: 046E26B3
                                          Strings
                                          • E|b, xrefs: 046E2683
                                          • setAttribute(attribute: Qt.ApplicationAttribute, on: bool = True), xrefs: 046E26DF
                                          • QCoreApplication, xrefs: 046E26E9
                                          • setAttribute, xrefs: 046E26E4
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Attribute@$?setApplicationApplication@@CoreQt@@_
                                          • String ID: E|b$QCoreApplication$setAttribute$setAttribute(attribute: Qt.ApplicationAttribute, on: bool = True)
                                          • API String ID: 4194155750-1999644469
                                          • Opcode ID: 3dcbd4cd744bc16d7f19640719a529382d30f4f70e4eb50b491c047bb31132df
                                          • Instruction ID: d8517a77667be22b8fd9373965185d75e456107309330f8886c567cd758dbd4e
                                          • Opcode Fuzzy Hash: 3dcbd4cd744bc16d7f19640719a529382d30f4f70e4eb50b491c047bb31132df
                                          • Instruction Fuzzy Hash: F901C070244301AFC740EB54EC41FA977E9FB88710F848968F868C7360E3B9A969CF02
                                          Function 046DA6C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setCurrent@QDir@@SA_NABVQString@@@Z.QT5CORE(?), ref: 046DA709
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046DA72E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setBool_Current@Dir@@FromLongString@@@
                                          • String ID: QDir$setCurrent$setCurrent(path: Optional[str]) -> bool
                                          • API String ID: 1675249408-3227521904
                                          • Opcode ID: 4f10dde6ea2154065d0f83a205bf1ca78bd43355dca52de1f9960c826620a3ab
                                          • Instruction ID: 179bbf6c54cfbac8e0561c4c56425cbb801e1e37aa5d59a71c52b87b8011185f
                                          • Opcode Fuzzy Hash: 4f10dde6ea2154065d0f83a205bf1ca78bd43355dca52de1f9960c826620a3ab
                                          • Instruction Fuzzy Hash: 49018474144201AFC701EB54EC45E9A7BE9FB88704F458858F85897321D279AD28DB62
                                          Function 046A2540 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?swap@QRegExp@@QAEXAAV1@@Z.QT5CORE(?), ref: 046A258A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?swap@Exp@@V1@@
                                          • String ID: BJ9$QTimeZone$swap$swap(self, other: QTimeZone)
                                          • API String ID: 3489884146-463703593
                                          • Opcode ID: 38cdd81fae2634c713e7a70eeda8993e8d4cdbf8b8164b3d7122293c9f5119eb
                                          • Instruction ID: 18be4bcf984a60956c0dee96c7dd250256d42bfe810c0a7a26767dd9af0ec0fb
                                          • Opcode Fuzzy Hash: 38cdd81fae2634c713e7a70eeda8993e8d4cdbf8b8164b3d7122293c9f5119eb
                                          • Instruction Fuzzy Hash: 3D019EB0244201AFC704DF54ED95EAA73E9FB88310F448968F868D7350E7B9AE16CF12
                                          Function 0469C510 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?swap@QRegExp@@QAEXAAV1@@Z.QT5CORE(?), ref: 0469C55A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?swap@Exp@@V1@@
                                          • String ID: BJ9$QRegularExpressionMatch$swap$swap(self, match: QRegularExpressionMatch)
                                          • API String ID: 3489884146-2009090330
                                          • Opcode ID: 315413666417b9379dd82d2ac18552fdcdda55e3d9d06cb3958a3b775c6a4e4a
                                          • Instruction ID: 7daea26ff5a66d7215801d928552f527b590f14869db7ae50170246d4f99c38a
                                          • Opcode Fuzzy Hash: 315413666417b9379dd82d2ac18552fdcdda55e3d9d06cb3958a3b775c6a4e4a
                                          • Instruction Fuzzy Hash: 0E019EB0244205AFC700DB54ED41EAA73E9FB88310F448928F869D3350E7B8EE16DB12
                                          Function 046985E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?swap@QRegExp@@QAEXAAV1@@Z.QT5CORE(?), ref: 0469862A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?swap@Exp@@V1@@
                                          • String ID: BJ9$QRegularExpressionMatchIterator$swap$swap(self, iterator: QRegularExpressionMatchIterator)
                                          • API String ID: 3489884146-2192916411
                                          • Opcode ID: 54c541129a2f6c5e0663f55b25c869d97e8ba9474550255fd3f31c1b62c6a217
                                          • Instruction ID: bc989faa3a59090b68a2eaaca770e96c158f8e7efad83ef8b77a49ac29c4d7ec
                                          • Opcode Fuzzy Hash: 54c541129a2f6c5e0663f55b25c869d97e8ba9474550255fd3f31c1b62c6a217
                                          • Instruction Fuzzy Hash: 54019EB0244205AFC700DB54ED41EAA73E9FB88310F448928F869D7350EBB8EE16CB02
                                          Function 046725A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?swap@QRegExp@@QAEXAAV1@@Z.QT5CORE(?), ref: 046725EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?swap@Exp@@V1@@
                                          • String ID: BJ9$QUrl$swap$swap(self, other: QUrl)
                                          • API String ID: 3489884146-3685039136
                                          • Opcode ID: 4c489631a715db935a18b037d5913a0eeee5be232149d917f6ca94bf2d436011
                                          • Instruction ID: 3d6edb57270eb60100afa3f05f76f2e2c63433697fa79d9329327757b1b65a05
                                          • Opcode Fuzzy Hash: 4c489631a715db935a18b037d5913a0eeee5be232149d917f6ca94bf2d436011
                                          • Instruction Fuzzy Hash: D3019EB4244201AFC704DB54EC81EAA73E9FB88314F448969FC68D7350E7B9EE16DB02
                                          Function 046CC580 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?removeEventFilter@QObject@@QAEXPAV1@@Z.QT5CORE(?), ref: 046CC5CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?removeEventFilter@Object@@V1@@
                                          • String ID: BJ8$QObject$removeEventFilter$removeEventFilter(self, a0: Optional[QObject])
                                          • API String ID: 1348412721-4034304571
                                          • Opcode ID: dbad314b298dda7d3d98c0d2dd8b42b42ab5c2c2a6b45b693c6b70081d4cdad1
                                          • Instruction ID: 0d92be80f5a794253f95798675ea9a44a35b283a458edb09ce479c3d0ef684dd
                                          • Opcode Fuzzy Hash: dbad314b298dda7d3d98c0d2dd8b42b42ab5c2c2a6b45b693c6b70081d4cdad1
                                          • Instruction Fuzzy Hash: 440140B4244201AFC701DB54DC41EAA77E9FB88310F84896CF869D3350E679AE16DB42
                                          Function 046486A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?swap@QVariant@@QAEXAAV1@@Z.QT5CORE(?), ref: 046486EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?swap@V1@@Variant@@
                                          • String ID: BJ9$QVariant$swap$swap(self, other: QVariant)
                                          • API String ID: 2528592883-2616993678
                                          • Opcode ID: ffda3c40710f621d213e9bdf3d5bccf01163066ebedf54a921d72895b88931ab
                                          • Instruction ID: 43ff4042f51bae397634278a5e08f96a9a88c3c3b5e986f47dac777bc6bc9a0a
                                          • Opcode Fuzzy Hash: ffda3c40710f621d213e9bdf3d5bccf01163066ebedf54a921d72895b88931ab
                                          • Instruction Fuzzy Hash: D30140B4244205AFC704DB54DD41EAA73E9FB88314F448969F868D7350E7B9AD16CB02
                                          Function 0469E6A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000001), ref: 0469E6F1
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 0469E701
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: QPoint$isNull$isNull(self) -> bool
                                          • API String ID: 2610644205-516216289
                                          • Opcode ID: c0e9256ec80fc1d87fa5ba30c2db99c0fa21347515830868b5c8bef68191e038
                                          • Instruction ID: a8f3d2d1ad9713e71ceaad3d9a7d8893fd6f409add3958042f3ade14a5af2e0e
                                          • Opcode Fuzzy Hash: c0e9256ec80fc1d87fa5ba30c2db99c0fa21347515830868b5c8bef68191e038
                                          • Instruction Fuzzy Hash: E80148B0A04201AFDB10EB54ED45FAA37E8FB54711F854864F848D6211E2BAEE58DA52
                                          Function 04674470 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setDevice@QTextStream@@QAEXPAVQIODevice@@@Z.QT5CORE(?), ref: 046744BF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setDevice@Device@@@Stream@@Text
                                          • String ID: BJ8$QTextStream$setDevice$setDevice(self, device: Optional[QIODevice])
                                          • API String ID: 2451470290-872343491
                                          • Opcode ID: 2b76507c66c06b32fb27c6871e1d548ed81904f75d6dadb52a5afcfba9f0b0c6
                                          • Instruction ID: 7117fdb15469f690195cb9975f4039f34693fb6a48004dc1f5bc4967cb109d8a
                                          • Opcode Fuzzy Hash: 2b76507c66c06b32fb27c6871e1d548ed81904f75d6dadb52a5afcfba9f0b0c6
                                          • Instruction Fuzzy Hash: 9F0140B4244201AFD705DF54EC81EA977E9FB88314F448568F868C7350E7B9AE16DB42
                                          Function 04694400 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setLocale@QResource@@QAEXABVQLocale@@@Z.QT5CORE(?), ref: 0469444F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setLocale@Locale@@@Resource@@
                                          • String ID: BJ9$QResource$setLocale$setLocale(self, locale: QLocale)
                                          • API String ID: 1112366132-3399921001
                                          • Opcode ID: 52973492a91bee21706b882757ade341bb493b7088f3e8b9069973bd8a27192a
                                          • Instruction ID: 9c3a326592b925712292d4ca467c945a3b701b14b9d638d14cafa2489c27f199
                                          • Opcode Fuzzy Hash: 52973492a91bee21706b882757ade341bb493b7088f3e8b9069973bd8a27192a
                                          • Instruction Fuzzy Hash: 300140B0244305AFCB05DF54EC41EAA73E9FB88714F448929F868D7350E7B9AE16DB02
                                          Function 0465E530 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?removeMappings@QSignalMapper@@QAEXPAVQObject@@@Z.QT5CORE(?), ref: 0465E57F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?removeMapper@@Mappings@Object@@@Signal
                                          • String ID: BJ8$QSignalMapper$removeMappings$removeMappings(self, sender: Optional[QObject])
                                          • API String ID: 2408109885-1765423454
                                          • Opcode ID: 2483d90585e288051b7802b0ab147068e80044197dbc417c51972ededc307a57
                                          • Instruction ID: 3c95185ad807e114e5f020e1e73d8a57a3ac52caedbb08a02fccfd48b7271dfa
                                          • Opcode Fuzzy Hash: 2483d90585e288051b7802b0ab147068e80044197dbc417c51972ededc307a57
                                          • Instruction Fuzzy Hash: 66012DB4244205AFC701DB54ED41EAA77E9FB4C314F448968FC69D3360E67AAE16DB02
                                          Function 046CA5E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?moveToThread@QObject@@QAEXPAVQThread@@@Z.QT5CORE(?), ref: 046CA62F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?moveObject@@Thread@Thread@@@
                                          • String ID: BJ8$QObject$moveToThread$moveToThread(self, thread: Optional[QThread])
                                          • API String ID: 2618143792-1479060690
                                          • Opcode ID: a8989edd4615c3eab216129683a0a0ad117d1466f13aec6fa5a9c65b3f6676d8
                                          • Instruction ID: 4fd8afd8410bbf1c2302abc29e83dbed736e28b2c457fc52c8526c3b24b171c2
                                          • Opcode Fuzzy Hash: a8989edd4615c3eab216129683a0a0ad117d1466f13aec6fa5a9c65b3f6676d8
                                          • Instruction Fuzzy Hash: 4E0180B0244206AFC701DF54EC81EA977E9FB88314F448929F869C3310E779AE16DB02
                                          Function 04670590 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?removeTransition@QState@@QAEXPAVQAbstractTransition@@@Z.QT5CORE(?), ref: 046705DF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?removeAbstractState@@Transition@Transition@@@
                                          • String ID: BJ<$QState$removeTransition$removeTransition(self, transition: Optional[QAbstractTransition])
                                          • API String ID: 3089790475-913699418
                                          • Opcode ID: 73d7738d95882ca6afbea534720cc903e57c35666746c4744acbda54e6e6fecf
                                          • Instruction ID: f9b7212a0134d50c515c11d464435e44fde0246fc6a8ba8e5a42cda95e427fa8
                                          • Opcode Fuzzy Hash: 73d7738d95882ca6afbea534720cc903e57c35666746c4744acbda54e6e6fecf
                                          • Instruction Fuzzy Hash: A50169B0244201AFC701DF54ED81EA977E9FB88314F448969FC68C3360E679AE1ACB02
                                          Function 04656660 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setSenderObject@QSignalTransition@@QAEXPBVQObject@@@Z.QT5CORE(?), ref: 046566AF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setObject@Object@@@SenderSignalTransition@@
                                          • String ID: BJ8$QSignalTransition$setSenderObject$setSenderObject(self, sender: Optional[QObject])
                                          • API String ID: 1718528499-3080492054
                                          • Opcode ID: 3fdc4486d693bcfc58776b725a068d005f6ed40e6bfed4cc0146c29dfc828826
                                          • Instruction ID: a16d604ecf719cad562f5a102699bdcaf26e6a9d421690303358bba71a7ce46c
                                          • Opcode Fuzzy Hash: 3fdc4486d693bcfc58776b725a068d005f6ed40e6bfed4cc0146c29dfc828826
                                          • Instruction Fuzzy Hash: 6B012DB4244205AFC701DF54EC41EAA77E9FB48314F448969FC69D3360E679AE16DB02
                                          Function 046E4620 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?removeNativeEventFilter@QCoreApplication@@QAEXPAVQAbstractNativeEventFilter@@@Z.QT5CORE(?), ref: 046E466F
                                          Strings
                                          • removeNativeEventFilter(self, filterObj: Optional[QAbstractNativeEventFilter]), xrefs: 046E4698
                                          • QCoreApplication, xrefs: 046E46A2
                                          • BJ8, xrefs: 046E4645
                                          • removeNativeEventFilter, xrefs: 046E469D
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: EventNative$?removeAbstractApplication@@CoreFilter@Filter@@@
                                          • String ID: BJ8$QCoreApplication$removeNativeEventFilter$removeNativeEventFilter(self, filterObj: Optional[QAbstractNativeEventFilter])
                                          • API String ID: 3815382428-1674576028
                                          • Opcode ID: aa9e7b541927341bad45ae1a71c48df7a283ae5ba353798ed54e17e35ba6a23e
                                          • Instruction ID: 646eb05ec199e7139196cb8f14160664c8bbed2b7015a47195c811e4d0cfcd4c
                                          • Opcode Fuzzy Hash: aa9e7b541927341bad45ae1a71c48df7a283ae5ba353798ed54e17e35ba6a23e
                                          • Instruction Fuzzy Hash: EF011774244205AFD700DF64E881EA977E9FB88310F448969F869C2360E679AE16DB12
                                          Function 0467A6D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?_fillRange@QRandomGenerator@@AAEXPAX0@Z.QT5CORE(?,?), ref: 0467A71A
                                          • PyLong_FromUnsignedLongLong.PYTHON3(?,?), ref: 0467A72C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$?_fillFromGenerator@@Long_RandomRange@Unsigned
                                          • String ID: QRandomGenerator$generate64$generate64(self) -> int
                                          • API String ID: 2257087042-3947329176
                                          • Opcode ID: 5da89d35ce38ed7551c989586ee56e1468f00a17c46d1acb00fbe6e9d0cde772
                                          • Instruction ID: cb0857b5a932df920dbd3882e020c71f067b8c99eb365aec0fa205cff40b5167
                                          • Opcode Fuzzy Hash: 5da89d35ce38ed7551c989586ee56e1468f00a17c46d1acb00fbe6e9d0cde772
                                          • Instruction Fuzzy Hash: B30171B4104302AFD700EFA4DC41DAB77E8FB88310F844C59F869D3211E678EA158F12
                                          Function 0040598B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$DecodeLocalesetlocale
                                          • String ID: Fatal error: unable to decode the command line argument #%i
                                          • API String ID: 2577174431-810459673
                                          • Opcode ID: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                          • Instruction ID: f47e09dd697b96e2b59eaf830e36c8aa388eac640d0f1e900355e8c5eb1699ce
                                          • Opcode Fuzzy Hash: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                          • Instruction Fuzzy Hash: 86011DB5A047018FDB10AF69E88526ABBE0EF05314F46093EE9C4A7341D33DE8858B99
                                          Function 0467A500 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?_fillRange@QRandomGenerator@@AAEXPAX0@Z.QT5CORE(?,?), ref: 0467A54B
                                          • PyLong_FromUnsignedLong.PYTHON3 ref: 0467A554
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?_fillFromGenerator@@LongLong_RandomRange@Unsigned
                                          • String ID: QRandomGenerator$generate$generate(self) -> int
                                          • API String ID: 1718097592-2269290666
                                          • Opcode ID: 36c040d4ac3b5a01430504666bdb5fefa7abd6a4afda2a44654540f79a46f5dc
                                          • Instruction ID: 82c5afedf2ec7f1f3695032e11bf690260e92fa55a4248b97aeb825c2c2d075f
                                          • Opcode Fuzzy Hash: 36c040d4ac3b5a01430504666bdb5fefa7abd6a4afda2a44654540f79a46f5dc
                                          • Instruction Fuzzy Hash: 8A018FB1104302ABCB00EB90DD45EAB7BE8FB84700F444868F949C3221E2B8EA19DB42
                                          Function 046C8600 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toggleBit@QBitArray@@QAE_NH@Z.QT5CORE(?), ref: 046C8649
                                          • PyBool_FromLong.PYTHON3(?), ref: 046C8653
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?toggleArray@@Bit@Bool_FromLong
                                          • String ID: QBitArray$toggleBit$toggleBit(self, i: int) -> bool
                                          • API String ID: 675671658-2926014106
                                          • Opcode ID: 3c1036c2042d4df548ea0807737b27fdf1b04d5245c0ac3fb2c5c719d4175b3a
                                          • Instruction ID: 5fc0a5627234f0c4894856cb124ec28c0fb77a872f5f1d69c568aab89d0e04b7
                                          • Opcode Fuzzy Hash: 3c1036c2042d4df548ea0807737b27fdf1b04d5245c0ac3fb2c5c719d4175b3a
                                          • Instruction Fuzzy Hash: 7301ADB0244201AFD700EF50EC05EAA77E8FB84310F448868FD58D3211E7B8EA289B43
                                          Function 04704500 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?parameterType@QMetaMethod@@QBEHH@Z.QT5CORE(?), ref: 04704549
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04704550
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?parameterFromLongLong_MetaMethod@@Type@
                                          • String ID: QMetaMethod$parameterType$parameterType(self, index: int) -> int
                                          • API String ID: 123615329-1206340794
                                          • Opcode ID: 0c277ad0812e516a5d06feeb57818895efd9a50cf69a8cfbe36737535db27158
                                          • Instruction ID: 5138cfdf0591a79d6b3c380442a1c5b79a537ab5bb145390458e4135e3d53e68
                                          • Opcode Fuzzy Hash: 0c277ad0812e516a5d06feeb57818895efd9a50cf69a8cfbe36737535db27158
                                          • Instruction Fuzzy Hash: 23016DB5544301AFC700DF94EC45EAA77E9FB84310F448868F969D2310E679EA19DB52
                                          Function 046A6440 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isEnabled@QSocketNotifier@@QBE_NXZ.QT5CORE ref: 046A6480
                                          • PyBool_FromLong.PYTHON3(?), ref: 046A648A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Enabled@FromLongNotifier@@Socket
                                          • String ID: QSocketNotifier$isEnabled$isEnabled(self) -> bool
                                          • API String ID: 728579260-2911202437
                                          • Opcode ID: 93b088055d1e24379a7955a1ee1ba06c55e76bd586fe5ee50f4a3c2da9d2b102
                                          • Instruction ID: aa5e36fc76bede9661ed4829e85e4ecc75d0c6b0cc6d20d5bbd16d0c23fc8587
                                          • Opcode Fuzzy Hash: 93b088055d1e24379a7955a1ee1ba06c55e76bd586fe5ee50f4a3c2da9d2b102
                                          • Instruction Fuzzy Hash: 10F044B0544201AFDB01EB54ED45DAA77E8FB84701F444864F958D3311E279EE18DB52
                                          Function 046E6450 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?deadlineNSecs@QDeadlineTimer@@QBE_JXZ.QT5CORE ref: 046E6490
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 046E6498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$?deadlineDeadlineFromLong_Secs@Timer@@
                                          • String ID: QDeadlineTimer$deadlineNSecs$deadlineNSecs(self) -> int
                                          • API String ID: 483997131-3515370272
                                          • Opcode ID: 2ff60ac42344ed885e189d8353f858ddd67dcd65f511defccb8c2bfec11b1953
                                          • Instruction ID: c763e26bfae2cff9132332fff9795df09296488979df76b271506c465682f160
                                          • Opcode Fuzzy Hash: 2ff60ac42344ed885e189d8353f858ddd67dcd65f511defccb8c2bfec11b1953
                                          • Instruction Fuzzy Hash: E6F044B0544201AFDB00EF64ED45DAA77F8FB84701F448868F859D3311E2B9AD19DB62
                                          Function 04658420 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?bytesTotal@QStorageInfo@@QBE_JXZ.QT5CORE ref: 04658460
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 04658468
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$?bytesFromInfo@@Long_StorageTotal@
                                          • String ID: QStorageInfo$bytesTotal$bytesTotal(self) -> int
                                          • API String ID: 1991151855-4240513390
                                          • Opcode ID: 7aa548c53b17d9fe196faa076e77b0c080d787e9b9f810aa468b5eda0fe594ea
                                          • Instruction ID: a17bf330c5abcbd481de71e83afd25b1f7047e045106d53034a59021a4c4c5d5
                                          • Opcode Fuzzy Hash: 7aa548c53b17d9fe196faa076e77b0c080d787e9b9f810aa468b5eda0fe594ea
                                          • Instruction Fuzzy Hash: 06F068B0544201AFCB01EF54ED45DAA77E9FB84701F444868F858D7311E279ED19DF62
                                          Function 04666420 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isAttached@QSharedMemory@@QBE_NXZ.QT5CORE ref: 04666460
                                          • PyBool_FromLong.PYTHON3(?), ref: 0466646A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Attached@Bool_FromLongMemory@@Shared
                                          • String ID: QSharedMemory$isAttached$isAttached(self) -> bool
                                          • API String ID: 3715673266-3922254435
                                          • Opcode ID: 04712bd9ae0165f2ee8686fce87873e696419151e24d2925d675096bbf8fdf10
                                          • Instruction ID: 428ee416b93c5d3e01c552aed21caacc7c80d113925728fb0d894b26411e5f90
                                          • Opcode Fuzzy Hash: 04712bd9ae0165f2ee8686fce87873e696419151e24d2925d675096bbf8fdf10
                                          • Instruction Fuzzy Hash: A7F04FB0544301AFCB00EF94ED45EAA77E8FB84701F844865F859D7311E2B9EE18DB62
                                          Function 046EA400 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isProleptic@QCalendar@@QBE_NXZ.QT5CORE ref: 046EA440
                                          • PyBool_FromLong.PYTHON3(?), ref: 046EA44A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Calendar@@FromLongProleptic@
                                          • String ID: QCalendar$isProleptic$isProleptic(self) -> bool
                                          • API String ID: 3558480120-2265792631
                                          • Opcode ID: 8f9a7af07b9a054cbe3a06a1d0c9331cb0059686741401f779bc97ec17c2d13b
                                          • Instruction ID: dea3d72de41d1ad9875fefae7e2958912301f012b11a3368b917380ab2cc48f2
                                          • Opcode Fuzzy Hash: 8f9a7af07b9a054cbe3a06a1d0c9331cb0059686741401f779bc97ec17c2d13b
                                          • Instruction Fuzzy Hash: 93F044B0544201AFCB00FF54ED45DAA77E8FB84701F444868F858D7311E679EE18DB52
                                          Function 046D44E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isReadable@QFileInfo@@QBE_NXZ.QT5CORE ref: 046D4520
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D452A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FileFromInfo@@LongReadable@
                                          • String ID: QFileInfo$isReadable$isReadable(self) -> bool
                                          • API String ID: 1758211913-532894766
                                          • Opcode ID: 5c6e5fe26a83c0c55c97f51d43c89ec03e614885e11293d9337f9d0f61d584e9
                                          • Instruction ID: cd39aec10b635e6070132637c479abd9e11b8b444c8b71e8c9b7cd92548f4363
                                          • Opcode Fuzzy Hash: 5c6e5fe26a83c0c55c97f51d43c89ec03e614885e11293d9337f9d0f61d584e9
                                          • Instruction Fuzzy Hash: ACF03CB0544202ABCB01EB54ED45EAA77E8FB84701F854868F859D2211E2B9EE199B52
                                          Function 046F44E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isConstant@QMetaProperty@@QBE_NXZ.QT5CORE ref: 046F4520
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F452A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Constant@FromLongMetaProperty@@
                                          • String ID: QMetaProperty$isConstant$isConstant(self) -> bool
                                          • API String ID: 3732714208-2744724260
                                          • Opcode ID: 073a6ea33dba9c508cb29c2995c6db9a449ccba5476a909dc67cfe6ff16f2c46
                                          • Instruction ID: 8555384407712bf4aeec60f5891ad60740ff50577781bf3729d010b93654b3f0
                                          • Opcode Fuzzy Hash: 073a6ea33dba9c508cb29c2995c6db9a449ccba5476a909dc67cfe6ff16f2c46
                                          • Instruction Fuzzy Hash: AEF04FB0544201AFCB00EF54ED46EAA77E8FB84701F854869F858D3311E279EE19DB52
                                          Function 046724F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isWritable@QSettings@@QBE_NXZ.QT5CORE ref: 04672530
                                          • PyBool_FromLong.PYTHON3(?), ref: 0467253A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLongSettings@@Writable@
                                          • String ID: QSettings$isWritable$isWritable(self) -> bool
                                          • API String ID: 3231351940-2951255255
                                          • Opcode ID: 42809d23ce9ce8dffe73f98dcf02bd5f212f0ca245f65ad7c48014695a56baf1
                                          • Instruction ID: c256e9d69424de392cac8791ae6cee4e78fcf3eca94aaa23a97675ecd5dc8938
                                          • Opcode Fuzzy Hash: 42809d23ce9ce8dffe73f98dcf02bd5f212f0ca245f65ad7c48014695a56baf1
                                          • Instruction Fuzzy Hash: 58F04FB0544201AFDB01EB54ED45EAA77E8FB84701F454878F858D7311E3B9EE28DB62
                                          Function 046D24D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?leaveContainer@QCborStreamReader@@QAE_NXZ.QT5CORE ref: 046D2510
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D251A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?leaveBool_CborContainer@FromLongReader@@Stream
                                          • String ID: QCborStreamReader$leaveContainer$leaveContainer(self) -> bool
                                          • API String ID: 138498107-348823126
                                          • Opcode ID: 9d673fd54d8e6946697da6e0f4889e741e79cdb5f2477585fe514dc2afbed019
                                          • Instruction ID: 7934ecb3e0abf307631035c6e734e4d482361097fbf8c7c7d4b6942a412d1bae
                                          • Opcode Fuzzy Hash: 9d673fd54d8e6946697da6e0f4889e741e79cdb5f2477585fe514dc2afbed019
                                          • Instruction Fuzzy Hash: 28F068B0544201AFCB00EF54ED45DAA77E8FB44701F484865F859D3311E279EE18DB53
                                          Function 046D6510 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isDir@QFileInfo@@QBE_NXZ.QT5CORE ref: 046D6550
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D655A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Dir@FileFromInfo@@Long
                                          • String ID: QFileInfo$isDir$isDir(self) -> bool
                                          • API String ID: 3342600842-2531910529
                                          • Opcode ID: 01dd78fef0cb0a0edf023f3a245fee9d9ad30e747502a503798cf290813321e2
                                          • Instruction ID: 72c5f133d07a73bb46d3f5f99aa32e43938214e8be5cc705172ff24ae49cf917
                                          • Opcode Fuzzy Hash: 01dd78fef0cb0a0edf023f3a245fee9d9ad30e747502a503798cf290813321e2
                                          • Instruction Fuzzy Hash: 20F08CB0544202AFCB01EB54ED45DAA37E8FB84701F854868F859D2211E2B9EE18DB62
                                          Function 046DA510 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?caching@QFileInfo@@QBE_NXZ.QT5CORE ref: 046DA550
                                          • PyBool_FromLong.PYTHON3(?), ref: 046DA55A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?caching@Bool_FileFromInfo@@Long
                                          • String ID: QFileInfo$caching$caching(self) -> bool
                                          • API String ID: 3145709237-490294525
                                          • Opcode ID: 041d5ea4ed16a546bc408f75ed6adb534b899a749547f6785aec1f8ba97c0faa
                                          • Instruction ID: 9c6d979907bd28cf84fd54ca375f6230a9acbd3e59dd5348c54d18ec5312b03c
                                          • Opcode Fuzzy Hash: 041d5ea4ed16a546bc408f75ed6adb534b899a749547f6785aec1f8ba97c0faa
                                          • Instruction Fuzzy Hash: F8F08CB0544202AFDB01EB64EC05EAA77E8FB84700F444868F859D2311E3B8EE199B62
                                          Function 046EA5E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?hasYearZero@QCalendar@@QBE_NXZ.QT5CORE ref: 046EA620
                                          • PyBool_FromLong.PYTHON3(?), ref: 046EA62A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?hasBool_Calendar@@FromLongYearZero@
                                          • String ID: QCalendar$hasYearZero$hasYearZero(self) -> bool
                                          • API String ID: 2106490934-4196117166
                                          • Opcode ID: 814009895ab4eba08e53b1d700241b035306d9a2d726424426e7f1621400e035
                                          • Instruction ID: 60743890e3d3994978a9ab14813464a54923373e162af992100ed97200497fe2
                                          • Opcode Fuzzy Hash: 814009895ab4eba08e53b1d700241b035306d9a2d726424426e7f1621400e035
                                          • Instruction Fuzzy Hash: 08F03CB0644201AFCB00FB64ED45DAA77E8FB84711F854868F858D7211E2B9EE29DB52
                                          Function 046685F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QUrl@@QBE_NXZ.QT5CORE ref: 04668630
                                          • PyBool_FromLong.PYTHON3(?), ref: 0466863A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLongUrl@@Valid@
                                          • String ID: QUrl$isValid$isValid(self) -> bool
                                          • API String ID: 972525317-3474333081
                                          • Opcode ID: 26d5df279c034fd0bd97f19203e3a1993baecd0a0aac0a188f024fa09f1ffa0e
                                          • Instruction ID: c6d92752aec3f013855ae8b7934a9639ff51bccb6c016b631146389dd492d279
                                          • Opcode Fuzzy Hash: 26d5df279c034fd0bd97f19203e3a1993baecd0a0aac0a188f024fa09f1ffa0e
                                          • Instruction Fuzzy Hash: 9CF0C2B0644202AFCB00EF54ED05EAA37E8FB84701F844864F848D7310E2B9EE28DB52
                                          Function 046F25A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?hasStdCppSet@QMetaProperty@@QBE_NXZ.QT5CORE ref: 046F25E0
                                          • PyBool_FromLong.PYTHON3(?), ref: 046F25EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?hasBool_FromLongMetaProperty@@Set@
                                          • String ID: QMetaProperty$hasStdCppSet$hasStdCppSet(self) -> bool
                                          • API String ID: 2859008387-2950333312
                                          • Opcode ID: 1453574f4e43ffd4301792b6d9dcceda7404d776303e03d656161931f826a90d
                                          • Instruction ID: ceb19acbfb8142784b272394b1c37ef237ba2ef98e13afa5f65a45abedfd392a
                                          • Opcode Fuzzy Hash: 1453574f4e43ffd4301792b6d9dcceda7404d776303e03d656161931f826a90d
                                          • Instruction Fuzzy Hash: 67F044B0544201AFDB00EF54ED45DAA77E8FB44711F444864F858D3311E279EE19DB52
                                          Function 046D8580 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QItemSelectionRange@@QBE_NXZ.QT5CORE ref: 046D85C0
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D85CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromItemLongRange@@SelectionValid@
                                          • String ID: QItemSelectionRange$isValid$isValid(self) -> bool
                                          • API String ID: 767375314-3236017190
                                          • Opcode ID: a0c1b390e58338339e782907022936d9a82a368658b30d9fd79a376ce02dcdc9
                                          • Instruction ID: bcd62bb50d0cdeb65d2c094ece1c9762e668e256f3f92a23ef3950fb89477c4a
                                          • Opcode Fuzzy Hash: a0c1b390e58338339e782907022936d9a82a368658b30d9fd79a376ce02dcdc9
                                          • Instruction Fuzzy Hash: DBF08CB0544202AFDA00EB54ED05EAA37E8FB84701F444868F858D3212E6B9EE189B62
                                          Function 04658670 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?bytesFree@QStorageInfo@@QBE_JXZ.QT5CORE ref: 046586B0
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 046586B8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$?bytesFree@FromInfo@@Long_Storage
                                          • String ID: QStorageInfo$bytesFree$bytesFree(self) -> int
                                          • API String ID: 326865264-460611067
                                          • Opcode ID: d577131cbdcbe954facf5b4035ad0031c6090a4ffa5e46ccc5390f3fe80e4923
                                          • Instruction ID: e9ba5cc7a6b2120a88832b3278102250cbeef21a507be7d16857cb75a6fe52a5
                                          • Opcode Fuzzy Hash: d577131cbdcbe954facf5b4035ad0031c6090a4ffa5e46ccc5390f3fe80e4923
                                          • Instruction Fuzzy Hash: 20F062B0544201AFDB00EF54ED45DAA77F9FB84701F444868F858D3311E2B9AE28DF62
                                          Function 04666640 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach@QSharedMemory@@QAE_NXZ.QT5CORE ref: 04666680
                                          • PyBool_FromLong.PYTHON3(?), ref: 0466668A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?detach@Bool_FromLongMemory@@Shared
                                          • String ID: QSharedMemory$detach$detach(self) -> bool
                                          • API String ID: 4013421903-3317384433
                                          • Opcode ID: 5ad28057a872dd83cd1b4e726f644945fe73297905f6b8ec41868382f91fda17
                                          • Instruction ID: 19faa07c4a1bf8533f6170c80fa7ae45bebe85cbf8de8ad54e764f023ddcbc12
                                          • Opcode Fuzzy Hash: 5ad28057a872dd83cd1b4e726f644945fe73297905f6b8ec41868382f91fda17
                                          • Instruction Fuzzy Hash: 81F0AFB0244201AFCB00EF54ED06EAA77E8FB84705F444864FD58D3310E2B9EE18DB62
                                          Function 0470A630 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isValid@QPersistentModelIndex@@QBE_NXZ.QT5CORE ref: 0470A670
                                          • PyBool_FromLong.PYTHON3(?), ref: 0470A67A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromIndex@@LongModelPersistentValid@
                                          • String ID: QPersistentModelIndex$isValid$isValid(self) -> bool
                                          • API String ID: 3331065690-3799983847
                                          • Opcode ID: c5599fc07047877f19d9f04da112466dc13f8c56e344c430c505be97e44b37ca
                                          • Instruction ID: 8fd76d8c836edb173a0bc6ca9049aaf5b2ed300882caa919fe64ccbab7f0c91b
                                          • Opcode Fuzzy Hash: c5599fc07047877f19d9f04da112466dc13f8c56e344c430c505be97e44b37ca
                                          • Instruction Fuzzy Hash: 2FF0A4B0544201EFCB00EF54ED45DAA77E8FB44700F444869F849D3310E279EE18DB52
                                          Function 0469C6C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isSortLocaleAware@QSortFilterProxyModel@@QBE_NXZ.QT5CORE ref: 0469C700
                                          • PyBool_FromLong.PYTHON3(?), ref: 0469C70A
                                          Strings
                                          • isSortLocaleAware, xrefs: 0469C721
                                          • isSortLocaleAware(self) -> bool, xrefs: 0469C71C
                                          • QSortFilterProxyModel, xrefs: 0469C726
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Sort$Aware@Bool_FilterFromLocaleLongModel@@Proxy
                                          • String ID: QSortFilterProxyModel$isSortLocaleAware$isSortLocaleAware(self) -> bool
                                          • API String ID: 3234998457-2561164767
                                          • Opcode ID: a9d0a26ab597cc06e95c6e5a30dae41085ce9005e46444b51c8b9e747d8bdbaa
                                          • Instruction ID: 8cebf2febbc2d61e6b9093bd2e5f91570abe10065670da6070df5822f77a3822
                                          • Opcode Fuzzy Hash: a9d0a26ab597cc06e95c6e5a30dae41085ce9005e46444b51c8b9e747d8bdbaa
                                          • Instruction Fuzzy Hash: BAF08CB4144201AFCA00EB94ED45EAA77E8FB84700F844868F849D3311E2B8AE19DB62
                                          Function 046E46C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isForever@QDeadlineTimer@@QBE_NXZ.QT5CORE ref: 046E4700
                                          • PyBool_FromLong.PYTHON3(?), ref: 046E470A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_DeadlineForever@FromLongTimer@@
                                          • String ID: QDeadlineTimer$isForever$isForever(self) -> bool
                                          • API String ID: 277608016-4227688490
                                          • Opcode ID: 89def3bb57b7be0af3aa8190bb1c59260657a00f4a8ff953450e8dcc824f2a4f
                                          • Instruction ID: 730c6f83185f5428481d5d3bccaa7bdc462dd677578e8c4b62e04458c332f821
                                          • Opcode Fuzzy Hash: 89def3bb57b7be0af3aa8190bb1c59260657a00f4a8ff953450e8dcc824f2a4f
                                          • Instruction Fuzzy Hash: CFF0AFB0544301AFDB00EB64ED05EAA73E8FB84701F444878F859D3310E2B8EE18DB52
                                          Function 046DC680 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isShortcut@QFileInfo@@QBE_NXZ.QT5CORE ref: 046DC6C0
                                          • PyBool_FromLong.PYTHON3(?), ref: 046DC6CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FileFromInfo@@LongShortcut@
                                          • String ID: QFileInfo$isShortcut$isShortcut(self) -> bool
                                          • API String ID: 831549560-1295052415
                                          • Opcode ID: 1696e0aa5f507c084813b20e32665256476034d3207e090ac9eb932efdb6233f
                                          • Instruction ID: 2bb374f9e78af76bd470e5e6232b33c6f7da858ab46c526241df05a2cbd73770
                                          • Opcode Fuzzy Hash: 1696e0aa5f507c084813b20e32665256476034d3207e090ac9eb932efdb6233f
                                          • Instruction Fuzzy Hash: F8F08CB0584205AFCB00EF54ED45DAA33E8FB84701F854868F859D3311E2B9EE19DB53
                                          Function 04694690 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?size@QResource@@QBE_JXZ.QT5CORE ref: 046946D0
                                          • PyLong_FromLongLong.PYTHON3(00000000), ref: 046946D8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Long$?size@FromLong_Resource@@
                                          • String ID: QResource$size$size(self) -> int
                                          • API String ID: 2614128651-3162938679
                                          • Opcode ID: e0f6c0c8ef9b314ca8ae016d780ca2e027ff72567f3af770a30e804fe234b339
                                          • Instruction ID: f09d285bcd1b51d11493e8b9c7704f170b2d1f372a14459005afb9b60ba45fe8
                                          • Opcode Fuzzy Hash: e0f6c0c8ef9b314ca8ae016d780ca2e027ff72567f3af770a30e804fe234b339
                                          • Instruction Fuzzy Hash: DDF0A4B0104201AFCB00EF54ED45DAA73E8FB84704F444824F848D3310E6B8AE15DF62
                                          Function 046D8770 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?isRelative@QDir@@QBE_NXZ.QT5CORE ref: 046D87B0
                                          • PyBool_FromLong.PYTHON3(?), ref: 046D87BA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Dir@@FromLongRelative@
                                          • String ID: QDir$isRelative$isRelative(self) -> bool
                                          • API String ID: 447265013-413983409
                                          • Opcode ID: 1730eeee49a08f96f3d39d90d5949b87af98c07cbc9c03198b509aa3402a053d
                                          • Instruction ID: e5cade549df90f9e42f273d8103079ba2f4b9cc5f1a7223755e69775f24cb5e2
                                          • Opcode Fuzzy Hash: 1730eeee49a08f96f3d39d90d5949b87af98c07cbc9c03198b509aa3402a053d
                                          • Instruction Fuzzy Hash: BEF04FB0544201AFDB00EB54ED46EAA77E8FB84705F854868F859D3311E279EE28DB62
                                          Function 046DE720 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?hasHtml@QMimeData@@QBE_NXZ.QT5CORE ref: 046DE760
                                          • PyBool_FromLong.PYTHON3(?), ref: 046DE76A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?hasBool_Data@@FromHtml@LongMime
                                          • String ID: QMimeData$hasHtml$hasHtml(self) -> bool
                                          • API String ID: 1398324101-2680550637
                                          • Opcode ID: 08153a193c0f458a83894e6d20872f46ea07ea9dbfad14064da01f957c506797
                                          • Instruction ID: fce13a48e3b0b9f6744c789bba92b932ad02f016310dfe969ca73e0e551bf5dc
                                          • Opcode Fuzzy Hash: 08153a193c0f458a83894e6d20872f46ea07ea9dbfad14064da01f957c506797
                                          • Instruction Fuzzy Hash: D0F08CB0544201AFCB00EB54ED45EAA37E8FB84701F444868F888D3211E2B9AA28DB62
                                          Function 04682450 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?available@QSemaphore@@QBEHXZ.QT5CORE ref: 04682490
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04682497
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?available@FromLongLong_Semaphore@@
                                          • String ID: QSemaphore$available$available(self) -> int
                                          • API String ID: 146332400-2527996077
                                          • Opcode ID: 235847728f85bff6cc09b603cb8d399b07a915ce6cddbdcd566f043ab42f9646
                                          • Instruction ID: 24f61204bca7cd5750c4f75399130fcf56ca20335d8005f9018814947aaedaf3
                                          • Opcode Fuzzy Hash: 235847728f85bff6cc09b603cb8d399b07a915ce6cddbdcd566f043ab42f9646
                                          • Instruction Fuzzy Hash: 52F04FB0544202AFCB01EF54ED46E9A77E8FB88701F444868F959D3311E2B9EE18DB62
                                          Function 04708410 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?column@QPersistentModelIndex@@QBEHXZ.QT5CORE ref: 04708450
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04708457
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?column@FromIndex@@LongLong_ModelPersistent
                                          • String ID: QPersistentModelIndex$column$column(self) -> int
                                          • API String ID: 1717136477-501372557
                                          • Opcode ID: 1006a58311cf4d81d895fa407b247b5dabfe499f40445ad0f7ce4f5a28cfd965
                                          • Instruction ID: d4e8715da1c94923c0c051c855289031db5f92978907becd75bbc31f9c8ab576
                                          • Opcode Fuzzy Hash: 1006a58311cf4d81d895fa407b247b5dabfe499f40445ad0f7ce4f5a28cfd965
                                          • Instruction Fuzzy Hash: 43F04FB4544201AFCB00EF54ED45DAA77E9FB44701F848868F859D3311E279AE18DB52
                                          Function 0467A400 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?propertyCount@QMetaObject@@QBEHXZ.QT5CORE ref: 0467A440
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0467A447
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?propertyCount@FromLongLong_MetaObject@@
                                          • String ID: QMetaObject$propertyCount$propertyCount(self) -> int
                                          • API String ID: 2266812512-2907893958
                                          • Opcode ID: 132ba3617cdb81ff2946e0b5647080d1b30a29891896432e881dad6479db762e
                                          • Instruction ID: eac56ced7d7c226350a76577891eb3ff6d4acdd802c4031d0c41b78471484277
                                          • Opcode Fuzzy Hash: 132ba3617cdb81ff2946e0b5647080d1b30a29891896432e881dad6479db762e
                                          • Instruction Fuzzy Hash: 96F062B0544201AFCB00EF94ED45EAA77E9FB44701F448868F859D3311E6B9EE18DB52
                                          Function 046C44C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?currentWriteChannel@QIODevice@@QBEHXZ.QT5CORE ref: 046C4500
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046C4507
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?currentChannel@Device@@FromLongLong_Write
                                          • String ID: QIODevice$currentWriteChannel$currentWriteChannel(self) -> int
                                          • API String ID: 3667228958-3537859759
                                          • Opcode ID: a0678086da4f4da20b5f6f3858a93f0f776ec85bb1357cd2fdbaeb8c05549dc1
                                          • Instruction ID: 2cd316f84114dc78b56ba104d967a98f6d352c4c0712a48f3acbbdf9cb35fa38
                                          • Opcode Fuzzy Hash: a0678086da4f4da20b5f6f3858a93f0f776ec85bb1357cd2fdbaeb8c05549dc1
                                          • Instruction Fuzzy Hash: 1BF04FB0544201AFCB01EF54ED45E9A77E8FB48701F444868F959D3311E2B9EE19DB62
                                          Function 046EE4D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 046EE510
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046EE517
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                          • String ID: QAbstractItemModel$senderSignalIndex$senderSignalIndex(self) -> int
                                          • API String ID: 2462028585-3234287455
                                          • Opcode ID: 86a00e1e4407d1331f634c9c3ce721f4055dbacf5faaf403e49cef124c5ffd0b
                                          • Instruction ID: d5ef189d6feb20c6ca106aac28e32789fde75e6c4b42eb6d5c22b89ff4514ba6
                                          • Opcode Fuzzy Hash: 86a00e1e4407d1331f634c9c3ce721f4055dbacf5faaf403e49cef124c5ffd0b
                                          • Instruction Fuzzy Hash: 0AF03CB0554241AFCB00EB54ED45EAA77E8FB88700F844868F858D3311E279FE19DF52
                                          Function 0470C4A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?restart@QTime@@QAEHXZ.QT5CORE ref: 0470C4E0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0470C4E7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?restart@FromLongLong_Time@@
                                          • String ID: QTime$restart$restart(self) -> int
                                          • API String ID: 1075243885-3624653450
                                          • Opcode ID: 4ac098e2301c91bb57b8b7b6db49dfa24a0f005765e1ed655150fe5139669481
                                          • Instruction ID: aed0371aaebd7f6a57bffd7d69bb2ab8e36a4f6db9eb3e73ebf9372e0e7e1a3b
                                          • Opcode Fuzzy Hash: 4ac098e2301c91bb57b8b7b6db49dfa24a0f005765e1ed655150fe5139669481
                                          • Instruction Fuzzy Hash: 0DF04FB0544201AFCB01EF94EC46EAA77E8FB44700F444868F859D7311E6B9AE19DB52
                                          Function 0465E4B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35threadtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?expiryTimeout@QThreadPool@@QBEHXZ.QT5CORE ref: 0465E4F0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0465E4F7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?expiryFromLongLong_Pool@@ThreadTimeout@
                                          • String ID: QThreadPool$expiryTimeout$expiryTimeout(self) -> int
                                          • API String ID: 2886743871-367617588
                                          • Opcode ID: da4aa0a01c69c04b837d0bd94a1bd0522e438d46c0a2272c01c2536f3a5e7c28
                                          • Instruction ID: 9cbfb8dc4bc1e2904c00057b69b729c9bf80b56daefdb7e7cb478d7a0c90fb0a
                                          • Opcode Fuzzy Hash: da4aa0a01c69c04b837d0bd94a1bd0522e438d46c0a2272c01c2536f3a5e7c28
                                          • Instruction Fuzzy Hash: 38F04FB0544201AFCB01EF54ED46E9A77E9FB88701F448864F858D7311E2B9EE18DB52
                                          Function 0467A480 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?classInfoCount@QMetaObject@@QBEHXZ.QT5CORE ref: 0467A4C0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0467A4C7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?classCount@FromInfoLongLong_MetaObject@@
                                          • String ID: QMetaObject$classInfoCount$classInfoCount(self) -> int
                                          • API String ID: 3304602757-3439613012
                                          • Opcode ID: 3e8419524f0fb471b6f1016bd297492dfa667154e1d66bde85a4d4ad5eae9ad3
                                          • Instruction ID: e7e9692c6bc1da31f7d30a63397f6080ffb3d4d3c3d04596120b81119ee1c128
                                          • Opcode Fuzzy Hash: 3e8419524f0fb471b6f1016bd297492dfa667154e1d66bde85a4d4ad5eae9ad3
                                          • Instruction Fuzzy Hash: 4EF068B0544201AFCB00EF94ED45E9A77E8FB44701F448864F959D3311E279FD18DB52
                                          Function 0467E490 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 0467E4D0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0467E4D7
                                          Strings
                                          • QSequentialAnimationGroup, xrefs: 0467E4F3
                                          • senderSignalIndex, xrefs: 0467E4EE
                                          • senderSignalIndex(self) -> int, xrefs: 0467E4E9
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                          • String ID: QSequentialAnimationGroup$senderSignalIndex$senderSignalIndex(self) -> int
                                          • API String ID: 2462028585-1147913481
                                          • Opcode ID: b892a5d8478c9f3dfb9fab3140b1abbe14e60fcb1af6ab9d78dc1c68762e164c
                                          • Instruction ID: 582760bd80b855f7fc835f358654d07f2b805e6923b6322ade65133c519fc88e
                                          • Opcode Fuzzy Hash: b892a5d8478c9f3dfb9fab3140b1abbe14e60fcb1af6ab9d78dc1c68762e164c
                                          • Instruction Fuzzy Hash: 09F04FB0644201AFCB00EF54ED45EAA77E9FB88700F444868F859D7311E2B9FE19DB52
                                          Function 04642540 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?captureCount@QRegularExpression@@QBEHXZ.QT5CORE ref: 04642580
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04642587
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?captureCount@Expression@@FromLongLong_Regular
                                          • String ID: QRegularExpression$captureCount$captureCount(self) -> int
                                          • API String ID: 1052828183-2232722616
                                          • Opcode ID: 2b04089f9e8a9bee12d9f7d5a645cf5fb54aaeb3ed7e43d173365574746f46c5
                                          • Instruction ID: 94ce8cea09c0246d3089a302200d35bacf51aa1a2b84b4d7e53d8cf8d928dbc7
                                          • Opcode Fuzzy Hash: 2b04089f9e8a9bee12d9f7d5a645cf5fb54aaeb3ed7e43d173365574746f46c5
                                          • Instruction Fuzzy Hash: F5F04FB4544201AFCB00EF54ED46E9A77E9FB84701F444868F859D3311E3B9EE29DB52
                                          Function 04690660 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?filterKeyColumn@QSortFilterProxyModel@@QBEHXZ.QT5CORE ref: 046906A0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046906A7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?filterColumn@FilterFromLongLong_Model@@ProxySort
                                          • String ID: QSortFilterProxyModel$filterKeyColumn$filterKeyColumn(self) -> int
                                          • API String ID: 3707927597-717403852
                                          • Opcode ID: 7f2e81e8170dc0a83e26b1d1f786f27b48737d56a13f6b8ceeefa97126fc7122
                                          • Instruction ID: 7bdb37d6b9c40f3ae03c9f9eb1372ef0270982f40c459e7fdff935bde9323d3f
                                          • Opcode Fuzzy Hash: 7f2e81e8170dc0a83e26b1d1f786f27b48737d56a13f6b8ceeefa97126fc7122
                                          • Instruction Fuzzy Hash: A2F08CB1244201AFCA00EB94ED05E9A37E8FB84700F444864F848D2310E3B8AE18DB52
                                          Function 046AA640 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 046AA680
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046AA687
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                          • String ID: QPluginLoader$senderSignalIndex$senderSignalIndex(self) -> int
                                          • API String ID: 2462028585-2519563785
                                          • Opcode ID: f223e9561bf337b646504cbcfe706c339e6c1f832dbe59a8f4e517ff380090fa
                                          • Instruction ID: efbd197297aa5a23328c1de9c26d0c7191566200ca54b73fe44f1ed689a98b22
                                          • Opcode Fuzzy Hash: f223e9561bf337b646504cbcfe706c339e6c1f832dbe59a8f4e517ff380090fa
                                          • Instruction Fuzzy Hash: FAF04FB0644201AFCB00EF94ED45DAA77E8FB88701F444869F859D3311E279AE19DF52
                                          Function 046E0620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?animationCount@QAnimationGroup@@QBEHXZ.QT5CORE ref: 046E0660
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046E0667
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?animationAnimationCount@FromGroup@@LongLong_
                                          • String ID: QAnimationGroup$animationCount$animationCount(self) -> int
                                          • API String ID: 2203806144-3460344228
                                          • Opcode ID: 1ef7445fb7245944236a88ceb7d37a314d0bbd26041dc8400a1a472c8284d4eb
                                          • Instruction ID: dbaace93e3f9af3d645eae72d0bc3af824680baf0edcf3dfb1444759e451fb4b
                                          • Opcode Fuzzy Hash: 1ef7445fb7245944236a88ceb7d37a314d0bbd26041dc8400a1a472c8284d4eb
                                          • Instruction Fuzzy Hash: 44F04FB0544202AFCB00EF64ED45E9A77E8FB84700F444868F958D3311E7B9AE19DB52
                                          Function 046D86F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?groupId@QFileInfo@@QBEIXZ.QT5CORE ref: 046D8730
                                          • PyLong_FromUnsignedLong.PYTHON3(00000000), ref: 046D8737
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?groupFileFromInfo@@LongLong_Unsigned
                                          • String ID: QFileInfo$groupId$groupId(self) -> int
                                          • API String ID: 3381768414-1926002664
                                          • Opcode ID: 8a9c402c53957fc5140611f32bb93b152026a522909c56dc8b47b7d40be9211e
                                          • Instruction ID: e44452040c8e5b1acdc45c8ca7c5d1cb978113bfda2897bdf537a88a64ce07e5
                                          • Opcode Fuzzy Hash: 8a9c402c53957fc5140611f32bb93b152026a522909c56dc8b47b7d40be9211e
                                          • Instruction Fuzzy Hash: E5F03CB0544201AFDB01EF94ED45DAA77E8FB84700F444878F859D3211E2B9AA59DB52
                                          Function 046666C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 04666700
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 04666707
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                          • String ID: QThread$senderSignalIndex$senderSignalIndex(self) -> int
                                          • API String ID: 2462028585-2126783021
                                          • Opcode ID: d63c0261655d84b9b5991b96f89a911f80f8f288f9d68f87d0ed7ab525e0651d
                                          • Instruction ID: 8e1736dfc2caf10cc279e16d166c1a317efa7e93e7db8d88081f962aaa646c33
                                          • Opcode Fuzzy Hash: d63c0261655d84b9b5991b96f89a911f80f8f288f9d68f87d0ed7ab525e0651d
                                          • Instruction Fuzzy Hash: D6F04FB4544201AFCB01EF54ED45EAA77E8FB88700F844878F859D7311E2B9AE19DF62
                                          Function 0470C6B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?elapsed@QTime@@QBEHXZ.QT5CORE ref: 0470C6F0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0470C6F7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?elapsed@FromLongLong_Time@@
                                          • String ID: QTime$elapsed$elapsed(self) -> int
                                          • API String ID: 3034194353-141735748
                                          • Opcode ID: 06ff1febe12b69c0916f09b83509b91cfc9b54455df57925c6ab27015f58cf8a
                                          • Instruction ID: 061574a307e7c2e2ed9107a54e9204191a0048d6250f1a93389df8e8a403afc4
                                          • Opcode Fuzzy Hash: 06ff1febe12b69c0916f09b83509b91cfc9b54455df57925c6ab27015f58cf8a
                                          • Instruction Fuzzy Hash: 16F04FB0544201AFDB01EF94ED46E9A77E8FB44700F444868F859D7311E3B9AE18DB52
                                          Function 046F2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?toTime_t@QDateTime@@QBEIXZ.QT5CORE ref: 046F27A0
                                          • PyLong_FromUnsignedLong.PYTHON3(00000000), ref: 046F27A7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DateFromLongLong_Time@@Time_t@Unsigned
                                          • String ID: QDateTime$toTime_t$toTime_t(self) -> int
                                          • API String ID: 15355010-1457803758
                                          • Opcode ID: bdd3d0fab0a4a2e25d6d8a39086896549a2d4d95e67fd858d139dd3624b3eaa1
                                          • Instruction ID: ae039ee662fac0247123ce1f6aac4504ac2ba5509f18e4276ed86b70f1eb6a28
                                          • Opcode Fuzzy Hash: bdd3d0fab0a4a2e25d6d8a39086896549a2d4d95e67fd858d139dd3624b3eaa1
                                          • Instruction Fuzzy Hash: 20F0AFB4204201AFDB00EB94EC45D9A37E8FB44700F444864F859D3311E3B9AE18CB52
                                          Function 046D4770 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?row@QPersistentModelIndex@@QBEHXZ.QT5CORE ref: 046D47B0
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 046D47B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?row@FromIndex@@LongLong_ModelPersistent
                                          • String ID: QItemSelectionRange$top$top(self) -> int
                                          • API String ID: 4057307544-1936967040
                                          • Opcode ID: 09d2281e4dfc198ce4af2da3ded5aea503fe5b0843031ee8f71a41fa512fe4f4
                                          • Instruction ID: e9c0c59067f8f74ea9ebc3d30a4a4ae0a40618541ae296973491d44fbf6f27a8
                                          • Opcode Fuzzy Hash: 09d2281e4dfc198ce4af2da3ded5aea503fe5b0843031ee8f71a41fa512fe4f4
                                          • Instruction Fuzzy Hash: 91F0AFB0544201AFCB00EF54EC41E9A37E9FB44700F444868F959D3311E3B9EE18CB52
                                          Function 0468A700 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 0468A740
                                          • PyLong_FromLong.PYTHON3(00000000), ref: 0468A747
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                          • String ID: QSaveFile$senderSignalIndex$senderSignalIndex(self) -> int
                                          • API String ID: 2462028585-2940349393
                                          • Opcode ID: 4e30546c10b1f55327d02e14406aeefb792eb0e94835366a503b6eedebdcb44d
                                          • Instruction ID: 70cb18df1610b28dcc2307200460aa87267418fbe584cc980aeaa7ee85128a8c
                                          • Opcode Fuzzy Hash: 4e30546c10b1f55327d02e14406aeefb792eb0e94835366a503b6eedebdcb44d
                                          • Instruction Fuzzy Hash: F8F04FB4544201AFCB01EFA4ED45DAA77E8FB88700F844978F858D3311E3B9AE19DB52
                                          Function 00403030 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _errno.MSVCRT ref: 00403064
                                          • strerror.MSVCRT ref: 0040306F
                                            • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Message_errnostrerror
                                          • String ID: %s%s: %s$0$Fatal error detected
                                          • API String ID: 132859757-319980707
                                          • Opcode ID: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                          • Instruction ID: e4a221d579113a631f8ff3878a8ccab0824710bde975c9094fb448246fb893e6
                                          • Opcode Fuzzy Hash: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                          • Instruction Fuzzy Hash: 540180B4409345DFC750EF65D18464ABBE0FF88749F408C2EE4C897251EB789948DF96
                                          Function 00401DBB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                            • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                          • free.MSVCRT ref: 00401D25
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                          • fwrite, xrefs: 00401DD1
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_errnofreestrerror
                                          • String ID: Failed to extract %s: failed to write data chunk!$fwrite
                                          • API String ID: 3523629215-1560601992
                                          • Opcode ID: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                          • Instruction ID: aff44569ab8606813c7f29ae03d31c1d370def72fb3cd313521a05d94b0daf67
                                          • Opcode Fuzzy Hash: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                          • Instruction Fuzzy Hash: 43F012B56093408BC700AF75E48519DB7E0BF80314F12892FF4999B291D338D485CB4A
                                          Function 046D24C0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyDict_Next.PYTHON3(?,?,?,?), ref: 047517D4
                                          • PyDict_Copy.PYTHON3(?), ref: 04751816
                                          • PyDict_DelItem.PYTHON3(?,?), ref: 04751828
                                          • PyDict_Next.PYTHON3(?,?,?,?), ref: 04751845
                                          • _Py_Dealloc.PYTHON3(?), ref: 04751871
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Dict_$Next$CopyDeallocItem
                                          • String ID:
                                          • API String ID: 1715201372-0
                                          • Opcode ID: 8f5735b21859381ee4a1c7a5410c6282a7d2ff1ec49be2b73de6a7b664cdaddf
                                          • Instruction ID: 81cfc75e0e7f4985f75a1d6139a4539dca66b4523dfcc12e27f7e3292b0b0779
                                          • Opcode Fuzzy Hash: 8f5735b21859381ee4a1c7a5410c6282a7d2ff1ec49be2b73de6a7b664cdaddf
                                          • Instruction Fuzzy Hash: 6A21EA32D003005BD7219F549C40BAB77ECEF482B6F480A79FD54DA220F765F6558792
                                          Function 04668460 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyList_New.PYTHON3(?), ref: 04668471
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ??0QLocale@@QAE@ABV0@@Z.QT5CORE(?), ref: 046684AC
                                          • PyList_SetItem.PYTHON3(00000000,00000000,00000000), ref: 046684D4
                                          • ??1QLocale@@QAE@XZ.QT5CORE ref: 046684F7
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04668519
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List_Locale@@$DeallocItemV0@@malloc
                                          • String ID:
                                          • API String ID: 1709696411-0
                                          • Opcode ID: 2045dfe91308732bb1c2b34647ed15052cfc064998339fe1380a133370a7156d
                                          • Instruction ID: d534452d47d7a13121caa50dfe36833964443df67d776169f8a21d954ef9b9ad
                                          • Opcode Fuzzy Hash: 2045dfe91308732bb1c2b34647ed15052cfc064998339fe1380a133370a7156d
                                          • Instruction Fuzzy Hash: A721F8762002009FD714EF68EC98E66B76AEFD43247088168E90B8B351EF75FC01C791
                                          Function 046585A0 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyList_New.PYTHON3(?), ref: 046585B1
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(?), ref: 046585EC
                                          • PyList_SetItem.PYTHON3(00000000,00000000,00000000), ref: 04658614
                                          • ??1QString@@QAE@XZ.QT5CORE ref: 04658637
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04658659
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List_$Array@@ByteDeallocItemString@@V0@@malloc
                                          • String ID:
                                          • API String ID: 1662835891-0
                                          • Opcode ID: 1d9e28bf63b5364f668669eced338f67c49da09d1ce392adfaf00b7b57016aa8
                                          • Instruction ID: 0a3c57d097395b0239578305c6afe3abb2a228706d27f3ce0699d1b1cf653a9c
                                          • Opcode Fuzzy Hash: 1d9e28bf63b5364f668669eced338f67c49da09d1ce392adfaf00b7b57016aa8
                                          • Instruction Fuzzy Hash: 2C210A723001009FD704EF68DC98E6AB769EFD4325B088568ED0A8B365EB75BC21C791
                                          Function 046747E0 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyList_New.PYTHON3(?), ref: 046747F1
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ??0QRegularExpression@@QAE@ABV0@@Z.QT5CORE(?), ref: 0467482C
                                          • PyList_SetItem.PYTHON3(00000000,00000000,00000000), ref: 04674854
                                          • ??1QCommandLineOption@@QAE@XZ.QT5CORE ref: 04674877
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 04674899
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List_$CommandDeallocExpression@@ItemLineOption@@RegularV0@@malloc
                                          • String ID:
                                          • API String ID: 1827271791-0
                                          • Opcode ID: e50b1b55580b2a70a44f4c4f300043ae151afb032fcbed95cf63433826c47600
                                          • Instruction ID: 365264089a3cb0e1d3e81dd8b39f5492196d3caf1274bc9775bee23d15d3d30e
                                          • Opcode Fuzzy Hash: e50b1b55580b2a70a44f4c4f300043ae151afb032fcbed95cf63433826c47600
                                          • Instruction Fuzzy Hash: F2210A727002049FD714DF68DC98E6AB769EFD53247088168EA0A8B391EF79FC05C791
                                          Function 00402A70 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DialogLongWindow$InvalidateRect
                                          • String ID:
                                          • API String ID: 1200242243-0
                                          • Opcode ID: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                          • Instruction ID: 27a3fa5a97dc3583b937ce51c481d096ba8d8761c7d493d8dec02a740509071e
                                          • Opcode Fuzzy Hash: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                          • Instruction Fuzzy Hash: 1A2160715082108FD310AF2CDA8925EBBE0FB84704F01893EF88A973D5D7B98949CB97
                                          Function 0040EA58 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                          • Instruction ID: e696c5700d6393410b77d795bc353bc03d311abb2f38c8898df76e4b882a8a07
                                          • Opcode Fuzzy Hash: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                          • Instruction Fuzzy Hash: 7C01D6B19093159FCB00AF65D64529EFBF0FF44344F12886EE488A7251E3789985CBCA
                                          Function 0040E887 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                          • Instruction ID: 3383cd8d3157cb3ed617c2d5b5c50993071427c57053a183d1f18b1378754ef2
                                          • Opcode Fuzzy Hash: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                          • Instruction Fuzzy Hash: 3DF0ECB19093009FCB40AF69D44529EFBE0EF84344F02CD6EE4D897211E7789895CB86
                                          Function 0040807B Relevance: 7.5, APIs: 5, Instructions: 26fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: clearerrfcloseferror$feoffreadfwrite
                                          • String ID:
                                          • API String ID: 2607417955-0
                                          • Opcode ID: 66c0c2ea02a2b8e64ab6b9e82169b908f71de578d98de76c2dec7fdd32821baf
                                          • Instruction ID: 6caf015234ffb0fe8031e1673ea91487ed83400b7f12cc8799a42872fabf3f27
                                          • Opcode Fuzzy Hash: 66c0c2ea02a2b8e64ab6b9e82169b908f71de578d98de76c2dec7fdd32821baf
                                          • Instruction Fuzzy Hash: D3E0AC71609B104AD3107F26A58116EF6E4AF80354F07492FE8E497291D77DC4C58B86
                                          Function 0469A540 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyType_IsSubtype.PYTHON3(?,0463D5F8), ref: 0469A55A
                                          • _Py_Dealloc.PYTHON3(?), ref: 0469A633
                                          • PyErr_Clear.PYTHON3 ref: 0469A648
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ClearDeallocErr_SubtypeType_
                                          • String ID: 1J1
                                          • API String ID: 3120778283-2174808320
                                          • Opcode ID: abf9855e03bf6e9f0fcb60d71c5a9e74efe18f450f103df4222a996833846454
                                          • Instruction ID: 2fe88bb54c6f99bbce14c47d2aaf8dbed361344497395e61f288d6786d613934
                                          • Opcode Fuzzy Hash: abf9855e03bf6e9f0fcb60d71c5a9e74efe18f450f103df4222a996833846454
                                          • Instruction Fuzzy Hash: E831C9712002019FCB04CF68E880AAAB7E9FF89325F148A29F869C7360F774ED55CB51
                                          Function 04644710 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyType_IsSubtype.PYTHON3(?,04FBB028), ref: 04644728
                                          • _Py_Dealloc.PYTHON3(?), ref: 046447DA
                                          • PyErr_Clear.PYTHON3 ref: 046447EF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ClearDeallocErr_SubtypeType_
                                          • String ID: 1J9
                                          • API String ID: 3120778283-2407233842
                                          • Opcode ID: 17d87a223b57b075a354e2c28eadd0ead018c4300ac9ab5801a74dae53adf49a
                                          • Instruction ID: 2688a4da0d42fc3a25b96942c1b48f4e85e915a8c1fa886ed392ef74b2fc1115
                                          • Opcode Fuzzy Hash: 17d87a223b57b075a354e2c28eadd0ead018c4300ac9ab5801a74dae53adf49a
                                          • Instruction Fuzzy Hash: A53191752006418FC704CF68E880A96B3E9FF99365B248A69F46AC7790EB75E852CB10
                                          Function 046E8550 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046E85E5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J9
                                          • API String ID: 2610644205-2407233842
                                          • Opcode ID: 2962f782e565bad93be9c7dffb8c00309e3a6946c9712b6ce16116b8c257eb18
                                          • Instruction ID: 2d703c8087d589f4b3a414d5264f367f0ecd18c9ef131ec842bf396b362746d4
                                          • Opcode Fuzzy Hash: 2962f782e565bad93be9c7dffb8c00309e3a6946c9712b6ce16116b8c257eb18
                                          • Instruction Fuzzy Hash: 7B219331605200EFDB10DF69DD41AAA37E5FF98314F488968F499C7261E73AE9948B42
                                          Function 04648760 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?compare@QVariant@@QBEHABV1@@Z.QT5CORE(?), ref: 046487D4
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046487FD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?compare@Bool_FromLongV1@@Variant@@
                                          • String ID: 1J1
                                          • API String ID: 3499697825-2174808320
                                          • Opcode ID: 1baa135be8e47a5a1913023845c95928ef43e9b11f1ce5f480c35a2b6a0879ed
                                          • Instruction ID: 3148bdb0a3ce1f077c2c6f451286e3c8fad0662f092883a3782206a43ce05e94
                                          • Opcode Fuzzy Hash: 1baa135be8e47a5a1913023845c95928ef43e9b11f1ce5f480c35a2b6a0879ed
                                          • Instruction Fuzzy Hash: 6B2180765042019FCB11DF58EC44EEA37E6FBC8324F084568F9648B350E77AE9198B52
                                          Function 0464A700 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?beginSelectTransitions@QStateMachine@@MAEXPAVQEvent@@@Z.QT5CORE(?), ref: 0464A778
                                          Strings
                                          • QPropertyAnimation, xrefs: 0464A7B3
                                          • updateDirection, xrefs: 0464A7AE
                                          • updateDirection(self, direction: QAbstractAnimation.Direction), xrefs: 0464A7A9
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?beginEvent@@@Machine@@SelectStateTransitions@
                                          • String ID: QPropertyAnimation$updateDirection$updateDirection(self, direction: QAbstractAnimation.Direction)
                                          • API String ID: 12784630-4231244175
                                          • Opcode ID: 8621106e9e890c93ef1febadb3fb443b8d1d53ee50a3fdc66e1da698d14bc498
                                          • Instruction ID: c4b556c32e2575ac882f742f33e7f7ad82ade5f9444027859c675eac645605a5
                                          • Opcode Fuzzy Hash: 8621106e9e890c93ef1febadb3fb443b8d1d53ee50a3fdc66e1da698d14bc498
                                          • Instruction Fuzzy Hash: DE215E79284201AFDB10DB94D881EA677F9FB88350F444468FC59C7360F679E919DB11
                                          Function 04644520 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?compare@QVersionNumber@@SAHABV1@0@Z.QT5CORE(00000000,?), ref: 04644583
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 04644591
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?compare@Bool_FromLongNumber@@V1@0@Version
                                          • String ID: 1J9
                                          • API String ID: 3725964080-2407233842
                                          • Opcode ID: 43892dd8c26d345846a527152d9272e00d767b81a890d8b34ea717ae4929dedc
                                          • Instruction ID: 71c05cc217958336447f5c65c7fefef0cc97aed1d952f7cf221c7f994fb77ee2
                                          • Opcode Fuzzy Hash: 43892dd8c26d345846a527152d9272e00d767b81a890d8b34ea717ae4929dedc
                                          • Instruction Fuzzy Hash: 4911B471100201AFCF159F68EC45EDA37E4FF88325F484568F8598A260E73AED248B52
                                          Function 046945C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??8QXmlStreamNotationDeclaration@@QBE_NABV0@@Z.QT5CORE(?), ref: 04694624
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 04694632
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Declaration@@FromLongNotationStreamV0@@
                                          • String ID: 1J9
                                          • API String ID: 443558394-2407233842
                                          • Opcode ID: 1b3fb768396b31b3532240a495220cae299e88acf65f11b3300cedd324a6d9ff
                                          • Instruction ID: e93bd3840744df8aa9a551ee508bb917c9475b25149a9c8297174515e8bba06f
                                          • Opcode Fuzzy Hash: 1b3fb768396b31b3532240a495220cae299e88acf65f11b3300cedd324a6d9ff
                                          • Instruction Fuzzy Hash: 03110271204201AFCB119F58EC14E9A37E4FF88324F08856CF8588B360E67AED248B92
                                          Function 046A0730 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??8?$QVector@VQXmlStreamAttribute@@@@QBE_NABV0@@Z.QT5CORE(?), ref: 046A0794
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046A07A2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ??8?$Attribute@@@@Bool_FromLongStreamV0@@Vector@
                                          • String ID: 1J9
                                          • API String ID: 1025387815-2407233842
                                          • Opcode ID: f248379bffc498315f49f4c09a587dc8a3e8ab754219f570bf9882f2bed357f4
                                          • Instruction ID: 143c623b78c9e78688f7b1be9ab4ffe996ead731f00d2b94bfb0a679474e70d8
                                          • Opcode Fuzzy Hash: f248379bffc498315f49f4c09a587dc8a3e8ab754219f570bf9882f2bed357f4
                                          • Instruction Fuzzy Hash: 3A11AF71100201AFCB119F68EC45ADE37E5FF48764F488568F8599A360E23AEE658F92
                                          Function 04642605 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?compare@QVersionNumber@@SAHABV1@0@Z.QT5CORE(00000000,?), ref: 04642663
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 04642671
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?compare@Bool_FromLongNumber@@V1@0@Version
                                          • String ID: 1J9
                                          • API String ID: 3725964080-2407233842
                                          • Opcode ID: 2c32be0c954482fe97a3eaf4132cda21e9d7c41dca2c42cbbc1e87db8c3e9949
                                          • Instruction ID: 0ce8ed2611e55675bbe0f5d67059464ea8105b4e177c9b35e5f10b602cf8e156
                                          • Opcode Fuzzy Hash: 2c32be0c954482fe97a3eaf4132cda21e9d7c41dca2c42cbbc1e87db8c3e9949
                                          • Instruction Fuzzy Hash: B111E671200201AFCB119F68FC55EDA37E4FF88324F4845A8F858CB360E27AE964CB52
                                          Function 04710550 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??9QModelIndex@@QBE_NABV0@@Z.QT5CORE(?), ref: 047105B4
                                          • PyBool_FromLong.PYTHON3(?), ref: 047105BE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromIndex@@LongModelV0@@
                                          • String ID: 1J9
                                          • API String ID: 3651534536-2407233842
                                          • Opcode ID: 09523d4fbe37a61f1857e4c1eef7fc4b9a0f6e39f4fa3962b3abc50198ef87cb
                                          • Instruction ID: d2f0a232b6cbf9eda43a4d1c4dec23c5f6e04cc07736f29ea75e5daaba00669f
                                          • Opcode Fuzzy Hash: 09523d4fbe37a61f1857e4c1eef7fc4b9a0f6e39f4fa3962b3abc50198ef87cb
                                          • Instruction Fuzzy Hash: 4D11B171500200AFCB119F68EC44D9A7BE5FF49724F484568F89AD6360D33AEA64DB62
                                          Function 04708530 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??8QLocale@@QBE_NABV0@@Z.QT5CORE(?), ref: 04708594
                                          • PyBool_FromLong.PYTHON3(?), ref: 0470859E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLocale@@LongV0@@
                                          • String ID: 1J9
                                          • API String ID: 3079742601-2407233842
                                          • Opcode ID: 9cb3f355b720f8ee567bcc7e5ae8a647eac585f005ebd0d2d71c48132a86faa4
                                          • Instruction ID: 56d9675d422ee2881306bd0ef2648357ad4d6de88da1ff6c2e832aff8084f1cd
                                          • Opcode Fuzzy Hash: 9cb3f355b720f8ee567bcc7e5ae8a647eac585f005ebd0d2d71c48132a86faa4
                                          • Instruction Fuzzy Hash: 0311B171101200EFCB10AF68EC45E9A37E5FF44720F488568F859D63A0D23AEA24DB62
                                          Function 04676590 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??9QUrl@@QBE_NABV0@@Z.QT5CORE(?), ref: 046765F4
                                          • PyBool_FromLong.PYTHON3(?), ref: 046765FE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLongUrl@@V0@@
                                          • String ID: 1J9
                                          • API String ID: 2607556440-2407233842
                                          • Opcode ID: c5cf8c8e49f7c90bc900838a60265d32a64a54a63bb50a5ceb9b226e1ce8bb6b
                                          • Instruction ID: ff2866eb132f319b84d054cc8a7e27e3282976623b03db34a507d815eda69c7a
                                          • Opcode Fuzzy Hash: c5cf8c8e49f7c90bc900838a60265d32a64a54a63bb50a5ceb9b226e1ce8bb6b
                                          • Instruction Fuzzy Hash: 5611B175600300AFCB10DF58EC44DAA3BE5FF48720F484568F8598A360E23AED24DB52
                                          Function 04646690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??8QRegularExpression@@QBE_NABV0@@Z.QT5CORE(?), ref: 046466F4
                                          • PyBool_FromLong.PYTHON3(?), ref: 046466FE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Expression@@FromLongRegularV0@@
                                          • String ID: 1J9
                                          • API String ID: 771298112-2407233842
                                          • Opcode ID: 8ad3f97931ca4574e75a545cfbac97dd1944cc9aa0fe8934e8913afb2abac273
                                          • Instruction ID: 1ec4732dbbf8df036f915944b0aecbd642511ef8367c92c3a3f34499b208c65d
                                          • Opcode Fuzzy Hash: 8ad3f97931ca4574e75a545cfbac97dd1944cc9aa0fe8934e8913afb2abac273
                                          • Instruction Fuzzy Hash: C411D375500201AFCB119F58EC44EEA3BE5FF85724F488568F859C6360E33AEA28DB52
                                          Function 04694710 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??8QXmlStreamNotationDeclaration@@QBE_NABV0@@Z.QT5CORE(?), ref: 04694774
                                          • PyBool_FromLong.PYTHON3(?), ref: 0469477E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_Declaration@@FromLongNotationStreamV0@@
                                          • String ID: 1J9
                                          • API String ID: 443558394-2407233842
                                          • Opcode ID: 12248006a27018604e6cd782403c9f298499856ac3f0aa6a1f19332cc4e358b5
                                          • Instruction ID: 09f05c86ad88a99b33dd29e2dc275a08e0e8d86274763ceb2b7813c297446fd9
                                          • Opcode Fuzzy Hash: 12248006a27018604e6cd782403c9f298499856ac3f0aa6a1f19332cc4e358b5
                                          • Instruction Fuzzy Hash: 98110671144211AFCB119F98EC44EEA37E9FF44324F088568F8588B350E67ADD24DB52
                                          Function 046904B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?revert@QAbstractItemModel@@UAEXXZ.QT5CORE ref: 04690519
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?revert@AbstractItemModel@@
                                          • String ID: QProcess$setupChildProcess$setupChildProcess(self)
                                          • API String ID: 325382164-3906972163
                                          • Opcode ID: 7d2ff467053e6e7fa3f94b0482e623a111e408911525a7ec4ab4427c7fb7f259
                                          • Instruction ID: 04f98e7fdd1e51f9ebb28d684ebfb09750b387399a452cc678af7ff1ad83ea97
                                          • Opcode Fuzzy Hash: 7d2ff467053e6e7fa3f94b0482e623a111e408911525a7ec4ab4427c7fb7f259
                                          • Instruction Fuzzy Hash: 82118EB02443019FCB50DB68ED81EA677E8EB45710F444465F819D7311E2B9FD15DB12
                                          Function 046D0750 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?clearCurrentIndex@QItemSelectionModel@@UAEXXZ.QT5CORE ref: 046D07B9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?clearCurrentIndex@ItemModel@@Selection
                                          • String ID: QItemSelectionModel$clearCurrentIndex$clearCurrentIndex(self)
                                          • API String ID: 87164015-278406032
                                          • Opcode ID: eb7d8bcbb7772a558ac54415d0f233a389d39d1764a48061df2c3809d3dc2028
                                          • Instruction ID: e7a55e2beb796d95b163ed24655fc3fe7667549949e34ebd55079f2d3f85fec2
                                          • Opcode Fuzzy Hash: eb7d8bcbb7772a558ac54415d0f233a389d39d1764a48061df2c3809d3dc2028
                                          • Instruction Fuzzy Hash: D61179746442029FC700EB64ED81EAA33E8EB84614F544468E819CB321F67ABD19DF21
                                          Function 046EA770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?fromVariant@QJsonValue@@SA?AV1@ABVQVariant@@@Z.QT5CORE(00000000,?,00000010), ref: 046EA7C1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?fromJsonValue@@Variant@Variant@@@malloc
                                          • String ID: QJsonValue$fromVariant$fromVariant(variant: Any) -> QJsonValue
                                          • API String ID: 4214476688-689160959
                                          • Opcode ID: 84fb4ff535feb7da1fd7e67e690fcf7f99eda5f5c2eb9c53f51f09562c4bcb6c
                                          • Instruction ID: aa9b82db837179b112b82667e9d245f0ed99b7ead615f76fac1014600b1203b9
                                          • Opcode Fuzzy Hash: 84fb4ff535feb7da1fd7e67e690fcf7f99eda5f5c2eb9c53f51f09562c4bcb6c
                                          • Instruction Fuzzy Hash: C711ACB4104201AFC701EF94EC41FDA7BE6FB88310F448868FA5897320D2BAAE54DB52
                                          Function 046E0570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setLibraryPaths@QCoreApplication@@SAXABVQStringList@@@Z.QT5CORE(?), ref: 046E05B8
                                          Strings
                                          • QCoreApplication, xrefs: 046E0606
                                          • setLibraryPaths, xrefs: 046E0601
                                          • setLibraryPaths(a0: Iterable[Optional[str]]), xrefs: 046E05FC
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setApplication@@CoreLibraryList@@@Paths@String
                                          • String ID: QCoreApplication$setLibraryPaths$setLibraryPaths(a0: Iterable[Optional[str]])
                                          • API String ID: 1899550599-1394724300
                                          • Opcode ID: 4e2f3c76ffd00b573196dcfcb0a7e5ff30d3ae071eff616fd19099691df256dc
                                          • Instruction ID: 16d316c46738a15a38d984f30ded2c946b198396be109ee65017162702acf2b6
                                          • Opcode Fuzzy Hash: 4e2f3c76ffd00b573196dcfcb0a7e5ff30d3ae071eff616fd19099691df256dc
                                          • Instruction Fuzzy Hash: 0D117C70244201AFC711DF58ED45EAA3BE6FB88700F444968F868D7320E3B9AE25DF42
                                          Function 046F6500 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?addMonths@QDateTime@@QBE?AV1@H@Z.QT5CORE(00000000,?), ref: 046F6554
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?addDateMonths@Time@@malloc
                                          • String ID: QDateTime$addMonths$addMonths(self, months: int) -> QDateTime
                                          • API String ID: 3266640917-3580422594
                                          • Opcode ID: e24e5ceaa207d2101d8452b25912f60c746eb1ef5ba950481f27ff4f309f431b
                                          • Instruction ID: f649caf8aac7a462866c75969fbfaac0dc3219a73ce252a268f9642649cef6c6
                                          • Opcode Fuzzy Hash: e24e5ceaa207d2101d8452b25912f60c746eb1ef5ba950481f27ff4f309f431b
                                          • Instruction Fuzzy Hash: 9101B5B0644201BFD701EB94EC41F9A77E8FB48710F448824FA59D7320E2B9EE19DB52
                                          Function 046FC5F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?persistentIndexList@QAbstractItemModel@@IBE?AV?$QList@VQModelIndex@@@@XZ.QT5CORE(00000000), ref: 046FC63E
                                          Strings
                                          • persistentIndexList(self) -> List[QModelIndex], xrefs: 046FC664
                                          • persistentIndexList, xrefs: 046FC669
                                          • QAbstractItemModel, xrefs: 046FC66E
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List@$?persistentAbstractIndexIndex@@@@ItemModelModel@@malloc
                                          • String ID: QAbstractItemModel$persistentIndexList$persistentIndexList(self) -> List[QModelIndex]
                                          • API String ID: 23101366-549980107
                                          • Opcode ID: 11eeafad546556108dbd7aa4c82515a48b25957a2067426658d22d30ab9f190e
                                          • Instruction ID: bd586b64a43a7ba432e18acaadfef72bff2f658420f3fd93b592ff21ad2985fb
                                          • Opcode Fuzzy Hash: 11eeafad546556108dbd7aa4c82515a48b25957a2067426658d22d30ab9f190e
                                          • Instruction Fuzzy Hash: A9017170244201AFDA10EB94EC41EDA37E5FB44710F444464F958D7311E6B9AE19CB92
                                          Function 047065A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?left@QByteArray@@QBE?AV1@H@Z.QT5CORE(00000000,?), ref: 047065F4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?left@Array@@Bytemalloc
                                          • String ID: QByteArray$left$left(self, len: int) -> QByteArray
                                          • API String ID: 157739911-3055081940
                                          • Opcode ID: 99faa5f6e552efe88d08061f6d83247f5b92367668b647f6d8b969d97c503fc5
                                          • Instruction ID: abde7a4f5fc1c695a3f7fe59fed33ce86ac5800feb5b5e1d733bddfb809d583e
                                          • Opcode Fuzzy Hash: 99faa5f6e552efe88d08061f6d83247f5b92367668b647f6d8b969d97c503fc5
                                          • Instruction Fuzzy Hash: 2401B1B0244205BFC701EB94ED41F9A77E9FB88710F448824F958D7320D6B9EE28DB92
                                          Function 0468A660 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?persistentIndexList@QAbstractItemModel@@IBE?AV?$QList@VQModelIndex@@@@XZ.QT5CORE(00000000), ref: 0468A6AE
                                          Strings
                                          • persistentIndexList, xrefs: 0468A6D9
                                          • persistentIndexList(self) -> List[QModelIndex], xrefs: 0468A6D4
                                          • QTransposeProxyModel, xrefs: 0468A6DE
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List@$?persistentAbstractIndexIndex@@@@ItemModelModel@@malloc
                                          • String ID: QTransposeProxyModel$persistentIndexList$persistentIndexList(self) -> List[QModelIndex]
                                          • API String ID: 23101366-1207460573
                                          • Opcode ID: 0ece04137a78749ddff2623b8afca54d561c65cd78c2b59169b1ff5de53a16a6
                                          • Instruction ID: 4435784e73b6f29cbfb620665050a30982b10d3e78734e6b91f9eb16be420991
                                          • Opcode Fuzzy Hash: 0ece04137a78749ddff2623b8afca54d561c65cd78c2b59169b1ff5de53a16a6
                                          • Instruction Fuzzy Hash: B0017170244201AFDA01EB94EC41EDE37E5FB88710F444464F958D7310E6B9AE19DB92
                                          Function 046CE6E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?deleteLater@QObject@@QAEXXZ.QT5CORE ref: 046CE720
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?deleteLater@Object@@
                                          • String ID: QObject$deleteLater$deleteLater(self)
                                          • API String ID: 2573861713-3188746578
                                          • Opcode ID: 87c13273d70c2888441464edd4e3216e162b46240b90e60e908b30dde8f8c02f
                                          • Instruction ID: a739a73c0de050784899dce63a67887ff7d917a3bb80edde133081c7d98da0d9
                                          • Opcode Fuzzy Hash: 87c13273d70c2888441464edd4e3216e162b46240b90e60e908b30dde8f8c02f
                                          • Instruction Fuzzy Hash: BD014C702442019FC700EF58ED41EA977E5FB88711F844869F869D7361E379BE19DB12
                                          Function 04678430 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setRealNumberNotation@QTextStream@@QAEXW4RealNumberNotation@1@@Z.QT5CORE(?), ref: 0467847F
                                          Strings
                                          • setRealNumberNotation(self, notation: QTextStream.RealNumberNotation), xrefs: 046784A8
                                          • QTextStream, xrefs: 046784B2
                                          • setRealNumberNotation, xrefs: 046784AD
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: NumberReal$?setNotation@Notation@1@@Stream@@Text
                                          • String ID: QTextStream$setRealNumberNotation$setRealNumberNotation(self, notation: QTextStream.RealNumberNotation)
                                          • API String ID: 1979621991-3745574408
                                          • Opcode ID: bbf504f2ef265d131ccdf63c9997160677206f51d5b45ddfd5f357dc363da9a8
                                          • Instruction ID: ece9a4582a9dbe09c1539e18d262f29ecaae6b17d7d4f30f3fd54c743ce80490
                                          • Opcode Fuzzy Hash: bbf504f2ef265d131ccdf63c9997160677206f51d5b45ddfd5f357dc363da9a8
                                          • Instruction Fuzzy Hash: 90015E74244205AFC701DF54EC45EA973E9FB88314F448968FC68C7360E7B9AE5ADB42
                                          Function 0468A470 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?entityDeclarations@QXmlStreamReader@@QBE?AV?$QVector@VQXmlStreamEntityDeclaration@@@@XZ.QT5CORE(00000000), ref: 0468A4BB
                                          Strings
                                          • QXmlStreamReader, xrefs: 0468A4EA
                                          • entityDeclarations(self) -> List[QXmlStreamEntityDeclaration], xrefs: 0468A4E0
                                          • entityDeclarations, xrefs: 0468A4E5
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Stream$?entityDeclaration@@@@Declarations@EntityReader@@Vector@malloc
                                          • String ID: QXmlStreamReader$entityDeclarations$entityDeclarations(self) -> List[QXmlStreamEntityDeclaration]
                                          • API String ID: 314948594-2111577057
                                          • Opcode ID: f3ef294e382815f93d021f658fd315ee59fc1fb317ebdd79160971c6709815a3
                                          • Instruction ID: 2ad973eb093ff083d4a724d2853c97c31a2a39e3ff0000003fc3668c9fcbe70f
                                          • Opcode Fuzzy Hash: f3ef294e382815f93d021f658fd315ee59fc1fb317ebdd79160971c6709815a3
                                          • Instruction Fuzzy Hash: EF0184B0644201AFDB01EF94EC41F9A37E4FB48700F444864F958D7310E2B9BD15DB52
                                          Function 04642420 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?errorString@QRegularExpression@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 0464246B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?errorExpression@@RegularString@String@@malloc
                                          • String ID: QRegularExpression$errorString$errorString(self) -> str
                                          • API String ID: 241296825-1775206142
                                          • Opcode ID: 5226f8530a59869e9c2d231cc15a334a76a401d7033c4ef41626b61cfee2fe9b
                                          • Instruction ID: 6b52a0354abaf01018d17c2567427853fdce6c3daefc7b5b23464f9d4cdb3fe6
                                          • Opcode Fuzzy Hash: 5226f8530a59869e9c2d231cc15a334a76a401d7033c4ef41626b61cfee2fe9b
                                          • Instruction Fuzzy Hash: AA0184B0544202AFDB00EB94EC41F9A33E9FB44704F444864F958D7311E2B9AE148BA2
                                          Function 046C0430 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?path@QDirIterator@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 046C047B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?path@Iterator@@String@@malloc
                                          • String ID: QDirIterator$path$path(self) -> str
                                          • API String ID: 2190085249-2241615991
                                          • Opcode ID: f650916e51ea18454ea15824b48a966529acc7a4f1dfd03789839c0347288675
                                          • Instruction ID: c95c1c87ea07c3c4034a4e3feb62c54603c050289c3c3a4b0cca3a3884dbc23c
                                          • Opcode Fuzzy Hash: f650916e51ea18454ea15824b48a966529acc7a4f1dfd03789839c0347288675
                                          • Instruction Fuzzy Hash: CA01A7B0544201AFDB00EB94ED41F9A37E9FB44704F448864F958D7311E2B9ED15CBA2
                                          Function 04690410 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?filterRegularExpression@QSortFilterProxyModel@@QBE?AVQRegularExpression@@XZ.QT5CORE(00000000), ref: 0469045B
                                          Strings
                                          • QSortFilterProxyModel, xrefs: 0469048A
                                          • filterRegularExpression, xrefs: 04690485
                                          • filterRegularExpression(self) -> QRegularExpression, xrefs: 04690480
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Regular$?filterExpression@Expression@@FilterModel@@ProxySortmalloc
                                          • String ID: QSortFilterProxyModel$filterRegularExpression$filterRegularExpression(self) -> QRegularExpression
                                          • API String ID: 1106900819-3178268887
                                          • Opcode ID: 3ccaef8be333c0e9435d4623e2e19fe8da17b6a816268c57db2add9fb26704f3
                                          • Instruction ID: 018c9639aa95a9f9057847d371ca00fe2035d7d603bbf0c61ea0d2f3b65c4a8d
                                          • Opcode Fuzzy Hash: 3ccaef8be333c0e9435d4623e2e19fe8da17b6a816268c57db2add9fb26704f3
                                          • Instruction Fuzzy Hash: 43018FB4644202AFDB00EB94EC41F9A37E9FB48714F444864F959D7320E2B9EE19DF62
                                          Function 047064D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?collation@QLocale@@QBE?AV1@XZ.QT5CORE(00000000), ref: 0470651B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?collation@Locale@@malloc
                                          • String ID: QLocale$collation$collation(self) -> QLocale
                                          • API String ID: 1777250183-1458673053
                                          • Opcode ID: 94c701886b34963c8e184cc11c9fcc516146e1558886a62a4e173f5664c5d4a6
                                          • Instruction ID: ee7d2e3ab96de22a2046dfe8c934bb175f78a8dbf57d88368c5d199b918672cf
                                          • Opcode Fuzzy Hash: 94c701886b34963c8e184cc11c9fcc516146e1558886a62a4e173f5664c5d4a6
                                          • Instruction Fuzzy Hash: 2101A7B0644201AFDB00EB94EC41F9A77E8FB84710F484864FA58D7311D2B9ED19DB52
                                          Function 0469A4A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setSortRole@QSortFilterProxyModel@@QAEXH@Z.QT5CORE(?), ref: 0469A4E9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Sort$?setFilterModel@@ProxyRole@
                                          • String ID: QSortFilterProxyModel$setSortRole$setSortRole(self, role: int)
                                          • API String ID: 3022092286-2390137247
                                          • Opcode ID: 068d785e33cd2a180ebf736e3b1d268a7c2887da5e1ab182aef0504abd5db8f9
                                          • Instruction ID: 6b868883d875f1023b180e12aaa86fd70d7143cb14b3f95df14b40c9af800020
                                          • Opcode Fuzzy Hash: 068d785e33cd2a180ebf736e3b1d268a7c2887da5e1ab182aef0504abd5db8f9
                                          • Instruction Fuzzy Hash: CC019E74244205AFC700DF54EC41EAA73E9FB88314F448928F869C3320E7B9AE16CF42
                                          Function 0468C4B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setPosition@QTextBoundaryFinder@@QAEXH@Z.QT5CORE(?), ref: 0468C4F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setBoundaryFinder@@Position@Text
                                          • String ID: QTextBoundaryFinder$setPosition$setPosition(self, position: int)
                                          • API String ID: 906306493-2132450830
                                          • Opcode ID: 39049eacbe722a510bb36811eea98b85c232e37ed861ebffbca1b54d2d0ad1ca
                                          • Instruction ID: 594cd26e761abcc6ee371eff3eb5fea2d1119f5a93414b084095bfcfd1eaa7b4
                                          • Opcode Fuzzy Hash: 39049eacbe722a510bb36811eea98b85c232e37ed861ebffbca1b54d2d0ad1ca
                                          • Instruction Fuzzy Hash: B7018074204201AFC701DF54EC41EA973E9FB48310F448969F869C7320E779AE15CF52
                                          Function 046C84B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?clearBit@QBitArray@@QAEXH@Z.QT5CORE(?), ref: 046C84F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?clearArray@@Bit@
                                          • String ID: QBitArray$clearBit$clearBit(self, i: int)
                                          • API String ID: 1880539955-4275691984
                                          • Opcode ID: b72b45dc661873fa37859b833ba386c05f1c7855d05643854b8cfcb9c1152a9b
                                          • Instruction ID: d47a17b7df360247b6087e4987b029f68d749972685b6b87e6ca90bf7592a932
                                          • Opcode Fuzzy Hash: b72b45dc661873fa37859b833ba386c05f1c7855d05643854b8cfcb9c1152a9b
                                          • Instruction Fuzzy Hash: 880140B4244201AFC701EF54ED41EA977E5FB88310F848569F968C3361E7B9AE15CB42
                                          Function 04708490 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?trimmed@QByteArray@@QGBE?AV1@XZ.QT5CORE(00000000), ref: 047084DB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?trimmed@Array@@Bytemalloc
                                          • String ID: QByteArray$trimmed$trimmed(self) -> QByteArray
                                          • API String ID: 3455530399-3669354477
                                          • Opcode ID: 26217cd0fb23cce6329349fe2ae7efd8ed613b6c4b02cd668587775101d04856
                                          • Instruction ID: 09560cb7dc80e2aa8bf957fe328b5117c8d7523744343d4799611cda3e5531d9
                                          • Opcode Fuzzy Hash: 26217cd0fb23cce6329349fe2ae7efd8ed613b6c4b02cd668587775101d04856
                                          • Instruction Fuzzy Hash: 3C01A7B0644201AFDB00EF94ED41F9A37E9FB44710F444864F959D3310E6B9ED18CB62
                                          Function 04652480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setCurrentTime@QTimeLine@@QAEXH@Z.QT5CORE(?), ref: 046524C9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setCurrentLine@@TimeTime@
                                          • String ID: QTimeLine$setCurrentTime$setCurrentTime(self, msec: int)
                                          • API String ID: 1684845808-450567422
                                          • Opcode ID: ee380a81f0a1b2fddf906cd2fa71ecaed79aee23cebdd8384b0c7c72eb25bd20
                                          • Instruction ID: 87217592ddb70a017d18cc6454f3ab52474b1ddf2142076e3ee65cc032a3286c
                                          • Opcode Fuzzy Hash: ee380a81f0a1b2fddf906cd2fa71ecaed79aee23cebdd8384b0c7c72eb25bd20
                                          • Instruction Fuzzy Hash: 6B014CB4204201AFC701DF54EC41EAA77E9FB88310F448569FC69D7360E7B9AA15CF42
                                          Function 04668550 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?center@QRect@@QBE?AVQPoint@@XZ.QT5CORE(00000000), ref: 0466859B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?center@Point@@Rect@@malloc
                                          • String ID: QRect$center$center(self) -> QPoint
                                          • API String ID: 1629757037-329580680
                                          • Opcode ID: 6789d7e84955e6cd02b06db3d9dac929639be4bfdb1d0a318b504535bbe8ea86
                                          • Instruction ID: f4762c6a98ad6d7580806f36a5edda89aadf85f3c4f06973f89d23c46eb70c7e
                                          • Opcode Fuzzy Hash: 6789d7e84955e6cd02b06db3d9dac929639be4bfdb1d0a318b504535bbe8ea86
                                          • Instruction Fuzzy Hash: DD01A2B0644201AFDB00EB94ED41F9A37E9FB88710F444864F959D3310E2B9FE18DBA2
                                          Function 04696550 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?uncompressedData@QResource@@QBE?AVQByteArray@@XZ.QT5CORE(00000000), ref: 0469659B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?uncompressedArray@@ByteData@Resource@@malloc
                                          • String ID: QResource$uncompressedData$uncompressedData(self) -> QByteArray
                                          • API String ID: 3530443386-392909553
                                          • Opcode ID: a265a24ff016889f3224ca902aa67c3417b87145073947be9e73ddeee19c65b8
                                          • Instruction ID: 064ac55ef203f0912a603739c230a6914a9bb68a1fab7da1df8dcbc112348c5c
                                          • Opcode Fuzzy Hash: a265a24ff016889f3224ca902aa67c3417b87145073947be9e73ddeee19c65b8
                                          • Instruction Fuzzy Hash: BE0184B0644201AFDB00EB94EC45F9A33E8FB44700F444868FA58D7310E6B9ED19DB52
                                          Function 04658500 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setDuration@QVariantAnimation@@QAEXH@Z.QT5CORE(?), ref: 04658549
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setAnimation@@Duration@Variant
                                          • String ID: QVariantAnimation$setDuration$setDuration(self, msecs: int)
                                          • API String ID: 3510363798-1940168957
                                          • Opcode ID: 8b618509a6c9f0fe7de593564ffeb298dd2d72d90e2e935e831611263366a3a3
                                          • Instruction ID: 9179597955d3bf7175647f2dd6ce803640daf77322bb7902e6153b2340cddd8a
                                          • Opcode Fuzzy Hash: 8b618509a6c9f0fe7de593564ffeb298dd2d72d90e2e935e831611263366a3a3
                                          • Instruction Fuzzy Hash: 34015E74244201AFC701DF54EC41EA977E9FB88310F848969FC68C7360E6B9AE1ADB42
                                          Function 04656510 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?endValue@QVariantAnimation@@QBE?AVQVariant@@XZ.QT5CORE(00000000), ref: 0465655B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAnimation@@Value@VariantVariant@@malloc
                                          • String ID: QVariantAnimation$endValue$endValue(self) -> Any
                                          • API String ID: 2867141510-3721076078
                                          • Opcode ID: 0cc066cbf63a2ea7d1713a9fa2819421feb1c5a137d5b3735c6095b42a151c7c
                                          • Instruction ID: 16359274150ad21b93f73bf65d7539d63772f9e5e24433019c3f21c3c9ef56d4
                                          • Opcode Fuzzy Hash: 0cc066cbf63a2ea7d1713a9fa2819421feb1c5a137d5b3735c6095b42a151c7c
                                          • Instruction Fuzzy Hash: 100184B0544201AFDB00EF94EC41F9A37E6FB48700F444864FA58D7311E2B9AE19DB92
                                          Function 046CE510 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?selection@QItemSelectionModel@@QBE?BVQItemSelection@@XZ.QT5CORE(00000000), ref: 046CE55B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Item$?selection@Model@@SelectionSelection@@malloc
                                          • String ID: QItemSelectionModel$selection$selection(self) -> QItemSelection
                                          • API String ID: 683063657-3583059322
                                          • Opcode ID: 00cae34b52baa35ad5e15e10b24a0891c74b5aad0ba27ef722186495c6e32805
                                          • Instruction ID: a716389e8a4a07fc71c6bf9802931bcd7438692e12e9b0b17d3e2499ac0374ba
                                          • Opcode Fuzzy Hash: 00cae34b52baa35ad5e15e10b24a0891c74b5aad0ba27ef722186495c6e32805
                                          • Instruction Fuzzy Hash: CB0184B0644201AFD700EBA4EC45F9A37E5FB84700F444828F958D3311E2B9AE15CB52
                                          Function 046A25E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?key@QSystemSemaphore@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 046A262B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?key@Semaphore@@String@@Systemmalloc
                                          • String ID: QSystemSemaphore$key$key(self) -> str
                                          • API String ID: 2127427083-950138476
                                          • Opcode ID: c7293ddad0a56e4af994db93a03a2aa0aa27577aa6e2c51d5af0b3061e51629d
                                          • Instruction ID: eafcb0c35f82553848b00a1b027907751b9be8160d02bbb492fedd639c078f32
                                          • Opcode Fuzzy Hash: c7293ddad0a56e4af994db93a03a2aa0aa27577aa6e2c51d5af0b3061e51629d
                                          • Instruction Fuzzy Hash: 500184B0644201AFDA00EB94EC41F9A37E9FB48704F448864F958D7311E2B9AD14CB62
                                          Function 046F05E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?percent@QLocale@@QBE?AVQChar@@XZ.QT5CORE(00000000), ref: 046F062B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?percent@Char@@Locale@@malloc
                                          • String ID: QLocale$percent$percent(self) -> str
                                          • API String ID: 2347223845-290319901
                                          • Opcode ID: 0b3c592627d356378cfbbc7d802c0cc5a8125f65a79da831927832fa1ae9c7ab
                                          • Instruction ID: 542f6f90d5ab47bceea9ae86f3aee49477d0d70ca583a02774a0fcc2016f6566
                                          • Opcode Fuzzy Hash: 0b3c592627d356378cfbbc7d802c0cc5a8125f65a79da831927832fa1ae9c7ab
                                          • Instruction Fuzzy Hash: 4801DBB0644201AFDB00EF94ED46F9A77E8FB48710F444424F959D3311E2B9ED15DB92
                                          Function 0465E5D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43threadtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setExpiryTimeout@QThreadPool@@QAEXH@Z.QT5CORE(?), ref: 0465E619
                                          Strings
                                          • QThreadPool, xrefs: 0465E64C
                                          • setExpiryTimeout, xrefs: 0465E647
                                          • setExpiryTimeout(self, expiryTimeout: int), xrefs: 0465E642
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setExpiryPool@@ThreadTimeout@
                                          • String ID: QThreadPool$setExpiryTimeout$setExpiryTimeout(self, expiryTimeout: int)
                                          • API String ID: 2358723795-193151932
                                          • Opcode ID: 83ce64cdcff2a5581fb80fd3e3f24322c4000d8f81d96d59cc5b1f8a56cc26fa
                                          • Instruction ID: a324209e2c344e58013f1a5879dcf1b0a836f9a6264dd0cd469d820cc998500c
                                          • Opcode Fuzzy Hash: 83ce64cdcff2a5581fb80fd3e3f24322c4000d8f81d96d59cc5b1f8a56cc26fa
                                          • Instruction Fuzzy Hash: F9015EB4244201AFC701DF54ED41EAA77E9FB88310F448569FC68C7360E679AE19DB42
                                          Function 0464A660 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?pattern@QRegExp@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 0464A6AB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?pattern@Exp@@String@@malloc
                                          • String ID: QRegExp$pattern$pattern(self) -> str
                                          • API String ID: 2442693603-2217774576
                                          • Opcode ID: 46d66d5ede67650ef97b95245bfcdd2d2d559de633a33e25692f0484bb06b664
                                          • Instruction ID: a1b7573ebc6eada0769565aa773cdc806b64de6db70bacdfb5d967c322a5dae1
                                          • Opcode Fuzzy Hash: 46d66d5ede67650ef97b95245bfcdd2d2d559de633a33e25692f0484bb06b664
                                          • Instruction Fuzzy Hash: 5201A7B0644202AFDB00EB94EC41F9A33E9FB44700F444864F958D7320E2B9FD55CBA2
                                          Function 04668670 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setStackSize@QThread@@QAEXI@Z.QT5CORE(?), ref: 046686B9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setSize@StackThread@@
                                          • String ID: QThread$setStackSize$setStackSize(self, stackSize: int)
                                          • API String ID: 911375415-954214313
                                          • Opcode ID: 3093b16095dea7a796df7aff9c08f1740eb44f5fb291af509bc263faa5ce8822
                                          • Instruction ID: ca6fc9d7900aae1049ea7d7a22b7eaf4f18a144681c9023b1b5125637bea40f3
                                          • Opcode Fuzzy Hash: 3093b16095dea7a796df7aff9c08f1740eb44f5fb291af509bc263faa5ce8822
                                          • Instruction Fuzzy Hash: E5015E74204201AFC701DF64EC41EAA77E9FB88310F548969FC69C7360E679AE15DF02
                                          Function 04684670 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?tokenString@QXmlStreamReader@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 046846BB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?tokenReader@@StreamString@String@@malloc
                                          • String ID: QXmlStreamReader$tokenString$tokenString(self) -> str
                                          • API String ID: 776007299-3680606460
                                          • Opcode ID: ba1d318ecd7384e88939033a39f4ba879d9924871743ab09cbe11a33b855a00c
                                          • Instruction ID: e2d86f4384f5e6001af18a2b89ff330c71cf1573729e7bf767f9dfbe94a651e3
                                          • Opcode Fuzzy Hash: ba1d318ecd7384e88939033a39f4ba879d9924871743ab09cbe11a33b855a00c
                                          • Instruction Fuzzy Hash: 910171B0644202AFDA00EF94EC41F9A33E5FB48704F444864F958D7351E2B9ED14DF62
                                          Function 046DA620 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setCaching@QFileInfo@@QAEX_N@Z.QT5CORE(?), ref: 046DA669
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setCaching@FileInfo@@
                                          • String ID: QFileInfo$setCaching$setCaching(self, on: bool)
                                          • API String ID: 517115922-1737769203
                                          • Opcode ID: 0a151c528ae0a2b3f49ddbd6ee5af8c2b6234a3e1fc799013324a82b993e7879
                                          • Instruction ID: c092de3e6140dddb03f78320f3f214db47e18da651a3e39e607ee2af406dd7cb
                                          • Opcode Fuzzy Hash: 0a151c528ae0a2b3f49ddbd6ee5af8c2b6234a3e1fc799013324a82b993e7879
                                          • Instruction Fuzzy Hash: 68019EB0244201AFC701EF64EC41EAA77E8FB88310F448529F869C3360E379AD16DB52
                                          Function 04674630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?fileName@QSettings@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 0467467B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?fileName@Settings@@String@@malloc
                                          • String ID: QSettings$fileName$fileName(self) -> str
                                          • API String ID: 1408372158-2756037437
                                          • Opcode ID: 00b01a9a566262b3ce9acd3488e49aa6dab5bb8eed5dd54bcc3f4c95f00303ef
                                          • Instruction ID: bed5e0dea3bcc66d21daed7b67e2b696b493c28e1fe796261bb5e2d191d9124f
                                          • Opcode Fuzzy Hash: 00b01a9a566262b3ce9acd3488e49aa6dab5bb8eed5dd54bcc3f4c95f00303ef
                                          • Instruction Fuzzy Hash: D901A2B0644202AFDB00EB94ED45F9A37E9FB88704F444824FA58D7310E2B9ED18CB62
                                          Function 04664610 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?defaultAnimations@QStateMachine@@QBE?AV?$QList@PAVQAbstractAnimation@@@@XZ.QT5CORE(00000000), ref: 0466465B
                                          Strings
                                          • defaultAnimations(self) -> List[QAbstractAnimation], xrefs: 04664680
                                          • defaultAnimations, xrefs: 04664685
                                          • QStateMachine, xrefs: 0466468A
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?defaultAbstractAnimation@@@@Animations@List@Machine@@Statemalloc
                                          • String ID: QStateMachine$defaultAnimations$defaultAnimations(self) -> List[QAbstractAnimation]
                                          • API String ID: 1069956255-1853708202
                                          • Opcode ID: dee871333e483821dc0075942986aa7c9054cbf40a4319739bfc470a5f756f9f
                                          • Instruction ID: fb58322461b3bfb873f93fc7f27046010c884d43e6303ad304968270829b4d78
                                          • Opcode Fuzzy Hash: dee871333e483821dc0075942986aa7c9054cbf40a4319739bfc470a5f756f9f
                                          • Instruction Fuzzy Hash: 5D0184B0644201AFDA00EFA4EC41F9A73E9FB88714F444824F958D7310E2B9ED14CB92
                                          Function 046A66C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setEnabled@QSocketNotifier@@QAEX_N@Z.QT5CORE(?), ref: 046A6709
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setEnabled@Notifier@@Socket
                                          • String ID: QSocketNotifier$setEnabled$setEnabled(self, a0: bool)
                                          • API String ID: 780818260-1536831563
                                          • Opcode ID: 2f2372f9ab736717fde3cc93e19206ec99cdf796630be6163e708f9d2ba47dec
                                          • Instruction ID: 90f0ed4b0afd24ab2d4a1f79c70669684dc72c5360f6acda4875350c25cc3f3c
                                          • Opcode Fuzzy Hash: 2f2372f9ab736717fde3cc93e19206ec99cdf796630be6163e708f9d2ba47dec
                                          • Instruction Fuzzy Hash: D7014CB4244201AFC701DF54EC81EA977E9FB88710F448969F868C7360E679ED15DB42
                                          Function 046786A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setRealNumberPrecision@QTextStream@@QAEXH@Z.QT5CORE(?), ref: 046786E9
                                          Strings
                                          • setRealNumberPrecision(self, precision: int), xrefs: 04678712
                                          • QTextStream, xrefs: 0467871C
                                          • setRealNumberPrecision, xrefs: 04678717
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setNumberPrecision@RealStream@@Text
                                          • String ID: QTextStream$setRealNumberPrecision$setRealNumberPrecision(self, precision: int)
                                          • API String ID: 943475518-486622216
                                          • Opcode ID: f43bdf7f5f27ba3a91afa617b552aceaf39d410927892e91984c4ac1ad44f52a
                                          • Instruction ID: 34abd34c5441a74fd587439d218dffcb1ab15c47e5e21e2f5db3490e811590b1
                                          • Opcode Fuzzy Hash: f43bdf7f5f27ba3a91afa617b552aceaf39d410927892e91984c4ac1ad44f52a
                                          • Instruction Fuzzy Hash: 13014CB4204205AFC700DF54EC81EA977E9FB88314F448569F869C7360E6BAAD19CF42
                                          Function 046C4770 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setCurrentWriteChannel@QIODevice@@QAEXH@Z.QT5CORE(?), ref: 046C47B9
                                          Strings
                                          • QIODevice, xrefs: 046C47EC
                                          • setCurrentWriteChannel(self, channel: int), xrefs: 046C47E2
                                          • setCurrentWriteChannel, xrefs: 046C47E7
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setChannel@CurrentDevice@@Write
                                          • String ID: QIODevice$setCurrentWriteChannel$setCurrentWriteChannel(self, channel: int)
                                          • API String ID: 1992751446-2988223609
                                          • Opcode ID: 66d393e868c487e64f08360e24351d5ee6ab14b7d237ef02a2f318b012a61068
                                          • Instruction ID: 4311eaa93789e5021a37ce973d546599eb0449ae8cd1c73918a1de92ae7acb04
                                          • Opcode Fuzzy Hash: 66d393e868c487e64f08360e24351d5ee6ab14b7d237ef02a2f318b012a61068
                                          • Instruction Fuzzy Hash: E3015E74244205AFC701DF54EC81EAA77E9FB88310F448969F869C3360E7B9AD1ACB52
                                          Function 04652740 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setPaused@QTimeLine@@QAEX_N@Z.QT5CORE(?), ref: 04652789
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setLine@@Paused@Time
                                          • String ID: QTimeLine$setPaused$setPaused(self, paused: bool)
                                          • API String ID: 44242813-3282730135
                                          • Opcode ID: 3bc7e4a3a03823ee5e7f35d736689e9171684a3feca4145e563872098f17f5cb
                                          • Instruction ID: df18fe8f214d14d0f989d44b6870dd60f608bc84d83c437ae96c9ccb30724892
                                          • Opcode Fuzzy Hash: 3bc7e4a3a03823ee5e7f35d736689e9171684a3feca4145e563872098f17f5cb
                                          • Instruction Fuzzy Hash: E80140B4244201AFC701DF54DC41E9A77E9FB48720F448969FC58D7360E779AA15CF42
                                          Function 04670730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?transitions@QState@@QBE?AV?$QList@PAVQAbstractTransition@@@@XZ.QT5CORE(00000000), ref: 0467077B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?transitions@AbstractList@State@@Transition@@@@malloc
                                          • String ID: QState$transitions$transitions(self) -> List[QAbstractTransition]
                                          • API String ID: 1282171574-309923635
                                          • Opcode ID: f3f0fefa96c0084de6d0d9b961862fbe1d74dd9e6a1fdb4116a08e487b5b7671
                                          • Instruction ID: f1dc3c1c14b41231b542b9111d2f06fc81e110b79d2e2486f79d5cf18dc1036c
                                          • Opcode Fuzzy Hash: f3f0fefa96c0084de6d0d9b961862fbe1d74dd9e6a1fdb4116a08e487b5b7671
                                          • Instruction Fuzzy Hash: 480184B0544201AFD700EB94EC41F9A33E5FB44704F444864F958D7321E2B9EE58CB62
                                          Function 04680730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?setAutoFormatting@QXmlStreamWriter@@QAEX_N@Z.QT5CORE(?), ref: 04680779
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?setAutoFormatting@StreamWriter@@
                                          • String ID: QXmlStreamWriter$setAutoFormatting$setAutoFormatting(self, a0: bool)
                                          • API String ID: 3002229108-954611536
                                          • Opcode ID: c776db4da166f6959e04173c3ac2bc04b81753d48182c7816fe2319cd119792f
                                          • Instruction ID: 84035058e69d085b1f9ec7bcf214f7a1995db3cc9897647febbd4b33343d8f6c
                                          • Opcode Fuzzy Hash: c776db4da166f6959e04173c3ac2bc04b81753d48182c7816fe2319cd119792f
                                          • Instruction Fuzzy Hash: 8F014074244301AFC701DF54EC41EA577E9FB88710F848969F869C3361E679AD16CF42
                                          Function 046CA710 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?canonicalPath@QDir@@QBE?AVQString@@XZ.QT5CORE(00000000), ref: 046CA75B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?canonicalDir@@Path@String@@malloc
                                          • String ID: QDir$canonicalPath$canonicalPath(self) -> str
                                          • API String ID: 330669245-3292365146
                                          • Opcode ID: 4482f125280e9a2cc49143205cab7be87128e548756328345bd825ba499a9a17
                                          • Instruction ID: 19235e7659d88062d767aeb16721124fc757dc2a15405d2cbf65debe779bfa00
                                          • Opcode Fuzzy Hash: 4482f125280e9a2cc49143205cab7be87128e548756328345bd825ba499a9a17
                                          • Instruction Fuzzy Hash: 7F01A2B0644201AFDB00EB94EC41F9A37E8FB88714F444824F959D7320E2B9FE15CB62
                                          Function 046824D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?writeEndElement@QXmlStreamWriter@@QAEXXZ.QT5CORE ref: 04682510
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?writeElement@StreamWriter@@
                                          • String ID: QXmlStreamWriter$writeEndElement$writeEndElement(self)
                                          • API String ID: 4009230105-3034522614
                                          • Opcode ID: c06785f6aad4b865932eff287352d14819e24e6a7b2582ec75c5eff66c4a7bd4
                                          • Instruction ID: 65dec17ec25a801d09d1aadef72e3bbbdef8ff8b2f8482449ac1cbc0244822b1
                                          • Opcode Fuzzy Hash: c06785f6aad4b865932eff287352d14819e24e6a7b2582ec75c5eff66c4a7bd4
                                          • Instruction Fuzzy Hash: 3501A2B42442019FC700EF54ED81DA577E9FB88710F844968F868D7351E379AD16DF52
                                          Function 0470A4B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?endInsertRows@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 0470A4F0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAbstractInsertItemModel@@Rows@
                                          • String ID: QIdentityProxyModel$endInsertRows$endInsertRows(self)
                                          • API String ID: 962192761-3933386803
                                          • Opcode ID: 3aff37370a9cf2a76bf86bc011fbd9392924f3e09785ed4a1ba128e3c34e9cba
                                          • Instruction ID: 40a765ea6617ec2759826b65db0ebb91ee79472d8186fb03eb3b89f7190047d9
                                          • Opcode Fuzzy Hash: 3aff37370a9cf2a76bf86bc011fbd9392924f3e09785ed4a1ba128e3c34e9cba
                                          • Instruction Fuzzy Hash: 28018F702442019FC700EF64ED41DA677E5FB48710F448868FC59D7350E6B9EE16DB12
                                          Function 0468A510 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?endInsertRows@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 0468A550
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAbstractInsertItemModel@@Rows@
                                          • String ID: QSortFilterProxyModel$endInsertRows$endInsertRows(self)
                                          • API String ID: 962192761-2995061563
                                          • Opcode ID: cc0926e1eb2bc2bbf51bcde3cec11144f43cb518949ca61160e8490db88c3a4f
                                          • Instruction ID: 937b036fdbcc2c28d703b5bf0519442ff8a529b819d20b448b3303d12b4f66eb
                                          • Opcode Fuzzy Hash: cc0926e1eb2bc2bbf51bcde3cec11144f43cb518949ca61160e8490db88c3a4f
                                          • Instruction Fuzzy Hash: 67017C742442019FCB00EB64ED41DA973E9FB48710F448969FC59D7310E2B9BE56DF12
                                          Function 04688590 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?closeWriteChannel@QProcess@@QAEXXZ.QT5CORE ref: 046885D0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?closeChannel@Process@@Write
                                          • String ID: QProcess$closeWriteChannel$closeWriteChannel(self)
                                          • API String ID: 427819767-2533995717
                                          • Opcode ID: 7212d9a5ec38f606561e09a0b407e591021283cc37b8cb14d217e66e458e15d0
                                          • Instruction ID: dce554693bb4f0ee827b81a83aa5c8cce6752b924ee8a9d39f756070489f7e7c
                                          • Opcode Fuzzy Hash: 7212d9a5ec38f606561e09a0b407e591021283cc37b8cb14d217e66e458e15d0
                                          • Instruction Fuzzy Hash: A4018BB0244301AFCB00EF58ED81DA977E4FB88710F844968F858D7360E6B9AE16CF52
                                          Function 046D06C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?endRemoveColumns@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 046D0700
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAbstractColumns@ItemModel@@Remove
                                          • String ID: QAbstractTableModel$endRemoveColumns$endRemoveColumns(self)
                                          • API String ID: 2466366528-57179497
                                          • Opcode ID: 67dcf3035c2e2210b90e06d7006b47a0a4a7219b2a8eac2a93eaf62407801070
                                          • Instruction ID: 22674b2a82a0e39aae4ea8547688bc291e8fbc4bf739c19e7d6ff0fbab221515
                                          • Opcode Fuzzy Hash: 67dcf3035c2e2210b90e06d7006b47a0a4a7219b2a8eac2a93eaf62407801070
                                          • Instruction Fuzzy Hash: D0018B70244201AFC700EF58ED41EAA77F5FB88710F444869F869D7350E6B9AD1ACF52
                                          Function 047006A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?endMoveRows@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 047006E0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAbstractItemModel@@MoveRows@
                                          • String ID: QConcatenateTablesProxyModel$endMoveRows$endMoveRows(self)
                                          • API String ID: 1329736929-2995884397
                                          • Opcode ID: 59bf2308ab9b751e3d7b33b4d46b14700f3213111b29473403629c49516cbd23
                                          • Instruction ID: c5b1055872a1c964eecceb30098323f57e27d293958fb529d8d354dfd4d68d3f
                                          • Opcode Fuzzy Hash: 59bf2308ab9b751e3d7b33b4d46b14700f3213111b29473403629c49516cbd23
                                          • Instruction Fuzzy Hash: 14014F742442019FCB01EF54ED41EA977E9FB88710F448568F859D7360E679AD15CB12
                                          Function 046CA680 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?reparse@QCborStreamReader@@QAEXXZ.QT5CORE ref: 046CA6C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?reparse@CborReader@@Stream
                                          • String ID: QCborStreamReader$reparse$reparse(self)
                                          • API String ID: 132560067-3106377746
                                          • Opcode ID: d9a9779f871261f5717bc672d9e4e016a41edb4de2e2a5235f11df2ba0f218b7
                                          • Instruction ID: 5d2c78868e8d495957bdf21f2164ee656f79517d2b3031688726230bc0f1ad2b
                                          • Opcode Fuzzy Hash: d9a9779f871261f5717bc672d9e4e016a41edb4de2e2a5235f11df2ba0f218b7
                                          • Instruction Fuzzy Hash: 33018FB02442059FCB00EF64ED41EAA77E5FB48710F844869F859D3350E679AD15DB52
                                          Function 046FC690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?endRemoveRows@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 046FC6D0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAbstractItemModel@@RemoveRows@
                                          • String ID: QConcatenateTablesProxyModel$endRemoveRows$endRemoveRows(self)
                                          • API String ID: 2070969689-97296326
                                          • Opcode ID: 8e2b4dfba05b8083e3e164d02249cd8876b7a6e35e4433b1c3caf1cdeacad2da
                                          • Instruction ID: 3eaeefb9336ac61a5dba4a1ca3efccaa4d30fa184790496ec1d0664ccbcb7d60
                                          • Opcode Fuzzy Hash: 8e2b4dfba05b8083e3e164d02249cd8876b7a6e35e4433b1c3caf1cdeacad2da
                                          • Instruction Fuzzy Hash: CE01D6702442059FC700EF54EC41EA973E5FB88710F444468F859D7310E7B9AD16DF52
                                          Function 0468C730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?endMoveColumns@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 0468C770
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?endAbstractColumns@ItemModel@@Move
                                          • String ID: QTransposeProxyModel$endMoveColumns$endMoveColumns(self)
                                          • API String ID: 2131576783-3739503214
                                          • Opcode ID: ecd552bae232868640d6ceda3a3d013fe553739fef34774a7e2e7ea5feb447b7
                                          • Instruction ID: 528e8e48e2d8f45352e489d545054a156c70e5f4de153565fbaf194abe3f0772
                                          • Opcode Fuzzy Hash: ecd552bae232868640d6ceda3a3d013fe553739fef34774a7e2e7ea5feb447b7
                                          • Instruction Fuzzy Hash: F0018FB42442059FCB00EF54EC41DAA77E5FB48710F844968F858D7310E779AD15CB52
                                          Function 047027F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?revert@QAbstractItemModel@@UAEXXZ.QT5CORE ref: 04702830
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?revert@AbstractItemModel@@
                                          • String ID: QAbstractItemModel$resetInternalData$resetInternalData(self)
                                          • API String ID: 325382164-1284290591
                                          • Opcode ID: 679357350ff0487e0e306c959e2da813ba3e72b22ff9537b599c679e4131e3e1
                                          • Instruction ID: 51307d299b27f21f913aacb2bf887abb911a0952a62e45bdd4c4f271f9787f5b
                                          • Opcode Fuzzy Hash: 679357350ff0487e0e306c959e2da813ba3e72b22ff9537b599c679e4131e3e1
                                          • Instruction Fuzzy Hash: F201A2742442019FCB00EF54ED85DA973E5FB48710F848868F868D3361D7B9AD1ACF52
                                          Function 04656480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?senderObject@QSignalTransition@@QBEPAVQObject@@XZ.QT5CORE ref: 046564C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?senderObject@Object@@SignalTransition@@
                                          • String ID: QSignalTransition$senderObject$senderObject(self) -> Optional[QObject]
                                          • API String ID: 746934501-3481184563
                                          • Opcode ID: fee73552edf454d5bf76cd2ce77141ca5ff7aa480bac4d7fc7ad2aa16b79da92
                                          • Instruction ID: 91cdf7e4b3ff75c377e9670375e46885aede52199f1ed72f955e2c4dc55b03c3
                                          • Opcode Fuzzy Hash: fee73552edf454d5bf76cd2ce77141ca5ff7aa480bac4d7fc7ad2aa16b79da92
                                          • Instruction Fuzzy Hash: F20181B0244202AFCB00EF94ED42EAA37E5FB48710F444864F958D3311E2B9EE19DB52
                                          Function 0469C480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?last@?$QVector@VQXmlStreamAttribute@@@@QAEAAVQXmlStreamAttribute@@XZ.QT5CORE ref: 0469C4C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Stream$?last@?$Attribute@@Attribute@@@@Vector@
                                          • String ID: QXmlStreamAttributes$last$last(self) -> QXmlStreamAttribute
                                          • API String ID: 1670111374-4068771741
                                          • Opcode ID: f071812feb6646c09820b7ffe0f1d83af6121b315aca0c345a4cde41f081649f
                                          • Instruction ID: a19a6957638e8e8b9f825ba3125896144a138a28888dac8bae2167956db0eb3b
                                          • Opcode Fuzzy Hash: f071812feb6646c09820b7ffe0f1d83af6121b315aca0c345a4cde41f081649f
                                          • Instruction Fuzzy Hash: 23011270644201AFC701EF94ED41EAA77E9FB48711F444868F958D7310E3B9EE15DB52
                                          Function 046805E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?codec@QXmlStreamWriter@@QBEPAVQTextCodec@@XZ.QT5CORE ref: 04680620
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?codec@Codec@@StreamTextWriter@@
                                          • String ID: QXmlStreamWriter$codec$codec(self) -> Optional[QTextCodec]
                                          • API String ID: 2280108898-2134538921
                                          • Opcode ID: 95a73d4f2ba943e346aa107d6032e209d7138c977df4bbf0787b62363016a438
                                          • Instruction ID: 7fc913acb59a8f988f8fa1685e8b59e3a8f7cdb86db60aea63bbeb5a37493c9a
                                          • Opcode Fuzzy Hash: 95a73d4f2ba943e346aa107d6032e209d7138c977df4bbf0787b62363016a438
                                          • Instruction Fuzzy Hash: B90162B0644302AFCB00EF94ED42E9A77E5FB48700F444868F958D7311E2B9AD199B52
                                          Function 046EC660 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?machine@QAbstractTransition@@QBEPAVQStateMachine@@XZ.QT5CORE ref: 046EC6A0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?machine@AbstractMachine@@StateTransition@@
                                          • String ID: QAbstractTransition$machine$machine(self) -> Optional[QStateMachine]
                                          • API String ID: 895164996-3837030206
                                          • Opcode ID: e8b6673b19718c55e53e73bc608fac6621a5cd9e222f5bf4b2462c1d163ddf1f
                                          • Instruction ID: a28af3c691dd1f604a9efa0a9be6c10cd2523f86d815d1d040ada7a4b42e626f
                                          • Opcode Fuzzy Hash: e8b6673b19718c55e53e73bc608fac6621a5cd9e222f5bf4b2462c1d163ddf1f
                                          • Instruction Fuzzy Hash: 92016DB0244201AFCB00EF94ED42E9A37E5FB88710F444864F958D7320E6B9AE18DB52
                                          Function 04676690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?iniCodec@QSettings@@QBEPAVQTextCodec@@XZ.QT5CORE ref: 046766D0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?iniCodec@Codec@@Settings@@Text
                                          • String ID: QSettings$iniCodec$iniCodec(self) -> Optional[QTextCodec]
                                          • API String ID: 2909422478-2465572126
                                          • Opcode ID: 37136928b6052cc3d50378652e75b56f99601e6697ed503bf290a03b9ebba1a7
                                          • Instruction ID: fcd2eab9b9970407c8c7cfa7a851110c36a961822c5d01170e3d254ef78aac93
                                          • Opcode Fuzzy Hash: 37136928b6052cc3d50378652e75b56f99601e6697ed503bf290a03b9ebba1a7
                                          • Instruction Fuzzy Hash: 28014FB1644201AFC701EB94ED42E9A37E5FB48710F484864F958D7310E2B9ED14DB52
                                          Function 0464E470 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?filterRole@QSortFilterProxyModel@@QBEHXZ.QT5CORE ref: 0464E4B0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?filterFilterModel@@ProxyRole@Sort
                                          • String ID: QTimeLine$state$state(self) -> QTimeLine.State
                                          • API String ID: 2525779105-1431182148
                                          • Opcode ID: 273d73c304d05b75cdd7f951a79cd9c8333068fbeaec7bbb03487199e049822d
                                          • Instruction ID: 403ec2b7e20c68eef917b23edfbad95838a69282ea226d2077d04b36adbe48c3
                                          • Opcode Fuzzy Hash: 273d73c304d05b75cdd7f951a79cd9c8333068fbeaec7bbb03487199e049822d
                                          • Instruction Fuzzy Hash: 520181B0644201AFCB01EF94ED41DAA37E5FB88710F444868F858D7310E3B9AE18DF62
                                          Function 046D4450 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?caseSensitivity@QRegExp@@QBE?AW4CaseSensitivity@Qt@@XZ.QT5CORE ref: 046D4490
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Sensitivity@$?caseCaseExp@@Qt@@
                                          • String ID: QLockFile$error$error(self) -> QLockFile.LockError
                                          • API String ID: 3848479068-3596714214
                                          • Opcode ID: 148af4ae7cac91d650fc1f3cfcf3af4ed8b527e7bc32ff2f69df738b7712e21d
                                          • Instruction ID: 74f00dccfe9423fc20e2af0b0e410e1b79e312a61d3a2b9aba6f020d85bb6c22
                                          • Opcode Fuzzy Hash: 148af4ae7cac91d650fc1f3cfcf3af4ed8b527e7bc32ff2f69df738b7712e21d
                                          • Instruction Fuzzy Hash: 73016DB0244201AFCB00EB94ED42D9A37E9FB88711F444868F868D3314E379AE14DB62
                                          Function 04684420 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?readNext@QXmlStreamReader@@QAE?AW4TokenType@1@XZ.QT5CORE ref: 04684460
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?readNext@Reader@@StreamTokenType@1@
                                          • String ID: QXmlStreamReader$readNext$readNext(self) -> QXmlStreamReader.TokenType
                                          • API String ID: 259816054-4119609136
                                          • Opcode ID: dc9cf4f15e87022d7d882b958ca8d3a0a6c8e54c3973f114bf6cca0b03c0e72e
                                          • Instruction ID: e5b1c7ba1f5cf8de65cfa4fd412798265c3dadf55e3e31b1952e20b65530dfb8
                                          • Opcode Fuzzy Hash: dc9cf4f15e87022d7d882b958ca8d3a0a6c8e54c3973f114bf6cca0b03c0e72e
                                          • Instruction Fuzzy Hash: E2016DB0244202AFCB11EF94ED41E9A33E9FB48710F444868F968D7311E3BDAD15DB52
                                          Function 046704B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?duration@QPauseAnimation@@UBEHXZ.QT5CORE ref: 046704F0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?duration@Animation@@Pause
                                          • String ID: QSettings$status$status(self) -> QSettings.Status
                                          • API String ID: 688934577-2827344044
                                          • Opcode ID: 56e8b6efcd4e236d33a4d7dfdd1204f50304ecbc2285999c473bc4c89d54450a
                                          • Instruction ID: 07b6d953a724b5774c4a3f374dd3958b1cb74ce47fc47683923b4dbe617de809
                                          • Opcode Fuzzy Hash: 56e8b6efcd4e236d33a4d7dfdd1204f50304ecbc2285999c473bc4c89d54450a
                                          • Instruction Fuzzy Hash: DA014BB0144201AFCB01EB94ED41E9A37E9FB88614F448864F958D3310E2B9AD149F62
                                          Function 046844B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?tokenType@QXmlStreamReader@@QBE?AW4TokenType@1@XZ.QT5CORE ref: 046844F0
                                          Strings
                                          • tokenType, xrefs: 04684518
                                          • QXmlStreamReader, xrefs: 0468451D
                                          • tokenType(self) -> QXmlStreamReader.TokenType, xrefs: 04684513
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?tokenReader@@StreamTokenType@Type@1@
                                          • String ID: QXmlStreamReader$tokenType$tokenType(self) -> QXmlStreamReader.TokenType
                                          • API String ID: 220846055-1673881042
                                          • Opcode ID: 42a212a4d89f6ea2f02a431963d91f56a74d845a5c248372534a63f3a8723c44
                                          • Instruction ID: 403765fb6afc9851a748444d2c6f72199719956ece82aeeb806d4cd4cb67309b
                                          • Opcode Fuzzy Hash: 42a212a4d89f6ea2f02a431963d91f56a74d845a5c248372534a63f3a8723c44
                                          • Instruction Fuzzy Hash: B2016DB4244202AFDB01EF94ED41E9A37E9FB88710F444868F968D7311E2B9EE15DB52
                                          Function 04678560 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?realNumberNotation@QTextStream@@QBE?AW4RealNumberNotation@1@XZ.QT5CORE ref: 046785A0
                                          Strings
                                          • realNumberNotation(self) -> QTextStream.RealNumberNotation, xrefs: 046785C3
                                          • realNumberNotation, xrefs: 046785C8
                                          • QTextStream, xrefs: 046785CD
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Number$?realNotation@Notation@1@RealStream@@Text
                                          • String ID: QTextStream$realNumberNotation$realNumberNotation(self) -> QTextStream.RealNumberNotation
                                          • API String ID: 2607214080-2261411021
                                          • Opcode ID: 70d18cb28459578b52e5d3b30dd8e2e42299ed7625bd5628901cb586c15636f2
                                          • Instruction ID: 6181b05d56e37603ee63466a653eacbf7d1bee24d2ca551db9fbd758eb07c636
                                          • Opcode Fuzzy Hash: 70d18cb28459578b52e5d3b30dd8e2e42299ed7625bd5628901cb586c15636f2
                                          • Instruction Fuzzy Hash: 39011DB0644202AFCB00EF94EC42D9A77E5FB88710F448864F958D7321E3B9EE559B52
                                          Function 046D0520 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046D056B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: QCborStreamReader$isInvalid$isInvalid(self) -> bool
                                          • API String ID: 2610644205-2018257214
                                          • Opcode ID: 9516fa91fa27e9bfa408ff5c802320cd67fb92c5ed513a8366b7a639b4b46a26
                                          • Instruction ID: 4c4dc74bc7710b135fc168d1a3b0602cfe0e20cbe4c3a349e786544c163c641c
                                          • Opcode Fuzzy Hash: 9516fa91fa27e9bfa408ff5c802320cd67fb92c5ed513a8366b7a639b4b46a26
                                          • Instruction Fuzzy Hash: 26F0C8B5544201AFCB00EF54ED01EAA77E8FB84710F884868F898D3311E379EE159B53
                                          Function 0467A590 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?enableTestMode@QStandardPaths@@SAX_N@Z.QT5CORE(?), ref: 0467A5C5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?enableMode@Paths@@StandardTest
                                          • String ID: QStandardPaths$enableTestMode$enableTestMode(testMode: bool)
                                          • API String ID: 1629068021-1734717285
                                          • Opcode ID: 794aad5ae349957ae2d4add8cfa2fef4b982f9a64b843dabbe463983d64647eb
                                          • Instruction ID: 334537bfb13bdff054fd24ebf0fee0448522802f2625898cc03ffeb703bb9965
                                          • Opcode Fuzzy Hash: 794aad5ae349957ae2d4add8cfa2fef4b982f9a64b843dabbe463983d64647eb
                                          • Instruction Fuzzy Hash: 3A0181B4244200AFD700EB58EC41DA937E5FB48310F848978F869C7321E679AD1ADB42
                                          Function 046CE600 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046CE64B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: QCborStreamReader$isString$isString(self) -> bool
                                          • API String ID: 2610644205-1433850984
                                          • Opcode ID: 12ed17146545a2fc43d036fb1fc2d03dac67eef207a0ecccb9cb2e47fa73a4fe
                                          • Instruction ID: 624f85c4427efc38aaaa76e8dcf630bbb0a2e09391b25eff3273310f025e9ff7
                                          • Opcode Fuzzy Hash: 12ed17146545a2fc43d036fb1fc2d03dac67eef207a0ecccb9cb2e47fa73a4fe
                                          • Instruction Fuzzy Hash: 92F0A4B4244201AFDB00EB54ED01E9A77E4FB44700F884868F898D3311E279EA159B52
                                          Function 046F46C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?textDirection@QLocale@@QBE?AW4LayoutDirection@Qt@@XZ.QT5CORE ref: 046F4700
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Direction@$?textLayoutLocale@@Qt@@
                                          • String ID: QLocale$textDirection$textDirection(self) -> Qt.LayoutDirection
                                          • API String ID: 4228649670-623449497
                                          • Opcode ID: f1767aa0458d944121b98866505069e3b6d52a484ae1a08d74e1806cd9c7ca03
                                          • Instruction ID: 6fd1e7a5d8bedde7a29c83d39f7c71104de6d3a67036a88685cb83b251a5d3eb
                                          • Opcode Fuzzy Hash: f1767aa0458d944121b98866505069e3b6d52a484ae1a08d74e1806cd9c7ca03
                                          • Instruction Fuzzy Hash: AC016270244201AFCB00EB94ED41D9A77E8FB88710F444864F958D7311E279AD15DB52
                                          Function 0467A770 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?enableTestMode@QStandardPaths@@SAX_N@Z.QT5CORE(?), ref: 0467A7A5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?enableMode@Paths@@StandardTest
                                          • String ID: QStandardPaths$setTestModeEnabled$setTestModeEnabled(testMode: bool)
                                          • API String ID: 1629068021-366183539
                                          • Opcode ID: 5ec76ffca94b437908b87d14174877d9ef718c939ae3b3c9af7e03008fa0f928
                                          • Instruction ID: 45119fd73bdb86011a398269f65e4c32818397f812b9599a78ae4c8f5cc000f6
                                          • Opcode Fuzzy Hash: 5ec76ffca94b437908b87d14174877d9ef718c939ae3b3c9af7e03008fa0f928
                                          • Instruction Fuzzy Hash: 670186B4644201EFC700EB54DC41E9977E5FB48710F448978F868C7321E679AD25DB02
                                          Function 04668710 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 04668757
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QRect$width$width(self) -> int
                                          • API String ID: 2938811853-473855772
                                          • Opcode ID: dd8212ddb9c483f0cadbb555cfe46878809271d11880ee50a06c432c2dd6abe0
                                          • Instruction ID: 3479e9f007e2d343d8f22c04804da5833c84b771d8d4e3f9a13e5642c1653603
                                          • Opcode Fuzzy Hash: dd8212ddb9c483f0cadbb555cfe46878809271d11880ee50a06c432c2dd6abe0
                                          • Instruction Fuzzy Hash: 93F0AFB4644201AFCB00EF58ED45EAA77E8FB88700F444868F859D3311E2B9FE18DB52
                                          Function 046FC4B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?currentDateTimeUtc@QDateTime@@SA?AV1@XZ.QT5CORE(00000000,00000004), ref: 046FC4E3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Date$?currentTimeTime@@Utc@malloc
                                          • String ID: QDateTime$currentDateTimeUtc$currentDateTimeUtc() -> QDateTime
                                          • API String ID: 876790064-3544645840
                                          • Opcode ID: fec85801e24c3c584220a7247bae8775896b177fdf4853f315b7e55e51840903
                                          • Instruction ID: 832cfd6e7bd9ce1d4db456611ec65e0578643f0c6cf22ca4d7747104629ab94e
                                          • Opcode Fuzzy Hash: fec85801e24c3c584220a7247bae8775896b177fdf4853f315b7e55e51840903
                                          • Instruction Fuzzy Hash: 68F090B0284302AFDA00EBA8DC49F8A33E4FB44310F048865F92AD7360D7B9ED519F12
                                          Function 046DA490 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?separator@QDir@@SA?AVQChar@@XZ.QT5CORE(00000000,00000002), ref: 046DA4C3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?separator@Char@@Dir@@malloc
                                          • String ID: QDir$separator$separator() -> str
                                          • API String ID: 1838426179-355593730
                                          • Opcode ID: 004291243d3da10e715505556b8d4db524391513c875c1d46fe700c50849ffc2
                                          • Instruction ID: 2953153eed0fec7c335c4c31669d683c0558c07df48ac6ffc7d06ab6db82da33
                                          • Opcode Fuzzy Hash: 004291243d3da10e715505556b8d4db524391513c875c1d46fe700c50849ffc2
                                          • Instruction Fuzzy Hash: 3EF090F0284301AFDB10EB98DC4AF9A37E8FB48310F048468F929D7360D6B8F9109B51
                                          Function 046545E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          • ?productType@QSysInfo@@SA?AVQString@@XZ.QT5CORE(00000000,00000004), ref: 04654613
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ?productInfo@@String@@Type@malloc
                                          • String ID: QSysInfo$productType$productType() -> str
                                          • API String ID: 1239782187-422191783
                                          • Opcode ID: 4e2aa047d8e3b990fc0a3668f7775bfde9837cee58c4af01463b91da9aeaa352
                                          • Instruction ID: 7f2c22351e8024924873d0644f34637445bcacadb2fc10e6669323737275531b
                                          • Opcode Fuzzy Hash: 4e2aa047d8e3b990fc0a3668f7775bfde9837cee58c4af01463b91da9aeaa352
                                          • Instruction Fuzzy Hash: A1F06DF0244201AFDA10DBA8DC85F9A33E4FB48310F048864F929D7360E6B8ED609B11
                                          Function 046586F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyFloat_FromDouble.PYTHON3 ref: 0465873D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DoubleFloat_From
                                          • String ID: QRectF$width$width(self) -> float
                                          • API String ID: 329246742-4242010139
                                          • Opcode ID: abb68a8c929423dbbca859f58a131600e555c817fdbc412831f3d7684fac06a7
                                          • Instruction ID: 66948888e398180f73a4e59545ea9fc06e5d5e587ffec7ddaf0d30dd8830833f
                                          • Opcode Fuzzy Hash: abb68a8c929423dbbca859f58a131600e555c817fdbc412831f3d7684fac06a7
                                          • Instruction Fuzzy Hash: 89F081B05442059FCB00FF58ED41D9A77E4FB44701F444864F858E7311E278EA199B62
                                          Function 004045D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                            • Part of subcall function 00408920: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                          Strings
                                          • GetModuleFileNameW, xrefs: 00404638
                                          • Failed to convert executable path to UTF-8., xrefs: 00404650
                                          • Failed to get executable path., xrefs: 00404630
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharFileModuleMultiNameWide
                                          • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                          • API String ID: 1532159127-1977442011
                                          • Opcode ID: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                          • Instruction ID: 0d2fa86ab14f13f7fcc6e2807861f5dff99018acd92cf068427be3d6d0997f9d
                                          • Opcode Fuzzy Hash: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                          • Instruction Fuzzy Hash: 7FF031B09083008BE700BF75D14925ABAE0AB94345F548C3EE8C887285E77E85989697
                                          Function 047107F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 04710835
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QByteArray$length$length(self) -> int
                                          • API String ID: 2938811853-2125102072
                                          • Opcode ID: 57eaf74fe958559500d82432674f5587bf2da0616b2aa1837115c7302eb05652
                                          • Instruction ID: d53bb4b9b37aae566f9abf126e2a8c1e761d57c2ff64d6a8ea512e657ccf2fe3
                                          • Opcode Fuzzy Hash: 57eaf74fe958559500d82432674f5587bf2da0616b2aa1837115c7302eb05652
                                          • Instruction Fuzzy Hash: 1AF04FB0544201AFCB00EF44ED46E9A77E4FB44700F844864F858D7321E379EE29DB52
                                          Function 00408987 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                            • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                          • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                          • calloc.MSVCRT ref: 004089EA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLastcalloc
                                          • String ID: Out of memory.$win32_utils_to_utf8
                                          • API String ID: 2784544953-3983694475
                                          • Opcode ID: 21bcc7d080ca5c9db2f0063a8681e6bc7762e4e6dc2f13102dfe4c2287896f93
                                          • Instruction ID: 7d0191ab155d1c36bf02162991644b0c6808e0cf9adbb8e4045d17a736bf9196
                                          • Opcode Fuzzy Hash: 21bcc7d080ca5c9db2f0063a8681e6bc7762e4e6dc2f13102dfe4c2287896f93
                                          • Instruction Fuzzy Hash: 5D0119B01083028FE310AF65D55835ABBE0EB80358F01893EE4E85B3D0D7B9C5498B87
                                          Function 04664410 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 04664452
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QRect$left$left(self) -> int
                                          • API String ID: 2938811853-153448523
                                          • Opcode ID: dbe0e01fcda5929654c70c3d11d70b4399cbefa91d9f73e69d094a83f86e9897
                                          • Instruction ID: ed94913fc9d6a491e5ebacf98f3a641870cf8f51ebd511a7534523a15576a7bb
                                          • Opcode Fuzzy Hash: dbe0e01fcda5929654c70c3d11d70b4399cbefa91d9f73e69d094a83f86e9897
                                          • Instruction Fuzzy Hash: D0F049B4244201AFCB00EB54ED42E9A77E9FB48701F844878F959D3311E2B9AA189B52
                                          Function 0466C560 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 0466C5A3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QOperatingSystemVersion$majorVersion$majorVersion(self) -> int
                                          • API String ID: 2938811853-1796193810
                                          • Opcode ID: 2286fc6e49ee5a7c9ee0cb083448a025879f9a5bf1103288a36623db6e8631d7
                                          • Instruction ID: 68e2060b306c5fb962b667404d88a1218e879e64a8ba978169dc921b88216a7d
                                          • Opcode Fuzzy Hash: 2286fc6e49ee5a7c9ee0cb083448a025879f9a5bf1103288a36623db6e8631d7
                                          • Instruction Fuzzy Hash: 30F062B4144201AFCB01EF44ED41E9A77E5FB44700F448869F959D3311E379EE289B92
                                          Function 04664590 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 046645D3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QRect$top$top(self) -> int
                                          • API String ID: 2938811853-1410122302
                                          • Opcode ID: d215bbb3874b609314a326ae5053b229084feab636d6a57032a031ddffa55ed8
                                          • Instruction ID: e672a15f32aefbaa2736c1cd5f6ca4422a893607c24be74aabbe003dc89c04ab
                                          • Opcode Fuzzy Hash: d215bbb3874b609314a326ae5053b229084feab636d6a57032a031ddffa55ed8
                                          • Instruction Fuzzy Hash: 96F049B4244201AFCB01EB94ED42E9A77E9FB48700F444869F85DD3311E279EE189B52
                                          Function 0470E760 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromVoidPtr.PYTHON3(?), ref: 0470E7A3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLong_Void
                                          • String ID: QModelIndex$internalId$internalId(self) -> int
                                          • API String ID: 721633577-1152366776
                                          • Opcode ID: 7c036a782d118b4a7445ead640aced40758bfc2bf42b8dfe16f2ab57f8376cef
                                          • Instruction ID: 5563b680f7f8ae1cb1ab92a6c29d2cc5eb931d2832652f79eae91fbdb2934fcb
                                          • Opcode Fuzzy Hash: 7c036a782d118b4a7445ead640aced40758bfc2bf42b8dfe16f2ab57f8376cef
                                          • Instruction Fuzzy Hash: 6AF04FB0144205AFDB00EB94ED41E9A77E9FB44700F484864F958D3311E2B9EE15DB52
                                          Function 0466C770 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyLong_FromLong.PYTHON3(?), ref: 0466C7B3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: FromLongLong_
                                          • String ID: QOperatingSystemVersion$minorVersion$minorVersion(self) -> int
                                          • API String ID: 2938811853-1571346134
                                          • Opcode ID: be97138d3bf64f28677b610c4de01188496bf6e37a56d9eebd123bb0b08eae77
                                          • Instruction ID: 2dcaea8805354642e255f66ee672ce379017d7fd368266cbdbd92fa7a7fd9d02
                                          • Opcode Fuzzy Hash: be97138d3bf64f28677b610c4de01188496bf6e37a56d9eebd123bb0b08eae77
                                          • Instruction Fuzzy Hash: BFF062B4144201AFCB01EF54EC41E9A77E9FB48700F444864F859D3311E379EE29DB52
                                          Function 00401DE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                            • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                          • fclose.MSVCRT ref: 00401D50
                                          • fclose.MSVCRT ref: 00401D63
                                          Strings
                                          • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                          • fseek, xrefs: 00401E01
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_errnostrerror
                                          • String ID: Failed to extract %s: failed to seek to the entry's data!$fseek
                                          • API String ID: 531001455-144044986
                                          • Opcode ID: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                          • Instruction ID: b1b358e5bfedda9d4d999058601c1f88ca93a78291f5d028d604a8f107234477
                                          • Opcode Fuzzy Hash: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                          • Instruction Fuzzy Hash: D2F06C756053419BCB00AF39D844299B7F1FF80318F05892FF89997390D338E985CB49
                                          Function 004174C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: atoisetlocalestrchr
                                          • String ID: .
                                          • API String ID: 1223908000-248832578
                                          • Opcode ID: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                          • Instruction ID: 5ece903d628136d3021f03f5de1dba085c6daeff515edd77d6e3c8bfb4f9f80e
                                          • Opcode Fuzzy Hash: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                          • Instruction Fuzzy Hash: 18E08CB0A087004BD7007F39C40A35BB6E2AB80308F8A882CE4CC87701F73DC8858786
                                          Function 00404DA3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: AddressProc$ErrorLast
                                          • String ID: Failed to get address for Py_UTF8Mode$GetProcAddress$Py_UTF8Mode
                                          • API String ID: 4214558900-2336683375
                                          • Opcode ID: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                          • Instruction ID: 29490028243a8bc7eb143a8c508494385d0dcc63e20c03701c217239cd601c8a
                                          • Opcode Fuzzy Hash: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                          • Instruction Fuzzy Hash: B7E0ECB18096108AC7106F39AA5519ABBE4BA4072CF018A2EE998572C0D778A985968E
                                          Function 0474E6D0 Relevance: 6.2, APIs: 4, Instructions: 172COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(00000001,00000001), ref: 0474E76B
                                          • ?dispose@QListData@@SAXPAUData@1@@Z.QT5CORE(00000000,?,04757EF0,?,?,04757EF0,?,04757EF4,04757EF4), ref: 0474E7EF
                                          • ??0QByteArray@@QAE@ABV0@@Z.QT5CORE(04757EF4,?,00000000,?,?,?,?,04757500,?,?), ref: 0474E81D
                                          • ?append@QListData@@QAEPAPAXXZ.QT5CORE(?,?,?,00000000,?,?,?,?,04757500,?,?), ref: 0474E861
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Data@@List$?append@?detach_grow@?dispose@Array@@ByteData@1@Data@1@@V0@@
                                          • String ID:
                                          • API String ID: 4071142825-0
                                          • Opcode ID: 3f7c80acc5199b475f4902e53586ce8c1fbe714d74a2838acfd2f5ba17b99e67
                                          • Instruction ID: 3fbfd8e9ae98cf31aad2fc6e6eec558dd0d854ef4739d4ed5274505e82ae6c9f
                                          • Opcode Fuzzy Hash: 3f7c80acc5199b475f4902e53586ce8c1fbe714d74a2838acfd2f5ba17b99e67
                                          • Instruction Fuzzy Hash: 8C61AE756002058FDB20DF18C88097AB3E9FF99328B18456DE999DB391E731FD19CBA1
                                          Function 00416DF0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          • IsDBCSLeadByteEx.KERNEL32 ref: 00416E42
                                          • MultiByteToWideChar.KERNEL32 ref: 00416E85
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Byte$CharLeadMultiWide
                                          • String ID:
                                          • API String ID: 2561704868-0
                                          • Opcode ID: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                          • Instruction ID: 73686868ec51103a6e9184972a812ecf3e9551738ac5fc900f4de2194f72883f
                                          • Opcode Fuzzy Hash: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                          • Instruction Fuzzy Hash: 6441F5B55093518FD710DF28E48429BBBE0BF86314F158A6EF89487390D77AD889CB87
                                          Function 00401001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: __p__commode__p__fmode__set_app_type
                                          • String ID:
                                          • API String ID: 3338496922-0
                                          • Opcode ID: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                          • Instruction ID: aeb446e45a19cd1e2d7087c0f9dd5afe65501be8eb4055b43830eca8bb231281
                                          • Opcode Fuzzy Hash: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                          • Instruction Fuzzy Hash: 2B219370600201CBD314AF30D8667A737E1BB00348F55867ED4887BAA6D77ED8C6DB99
                                          Function 0465E670 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyList_New.PYTHON3(?), ref: 0465E67D
                                          • PyLong_FromLong.PYTHON3(?), ref: 0465E6AE
                                          • PyList_SetItem.PYTHON3(00000000,?,00000000), ref: 0465E6BA
                                          • _Py_Dealloc.PYTHON3(00000000), ref: 0465E6E3
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: List_$DeallocFromItemLongLong_
                                          • String ID:
                                          • API String ID: 2038545694-0
                                          • Opcode ID: dc9c94bda9c1477c365a8ae4fdbfcb89b46577e91a16baed6ab467a8e9c95b73
                                          • Instruction ID: 3af567e116948ead812a0ef11a639bc75f5ae9b957fb9198a9b6a935726cd0cc
                                          • Opcode Fuzzy Hash: dc9c94bda9c1477c365a8ae4fdbfcb89b46577e91a16baed6ab467a8e9c95b73
                                          • Instruction Fuzzy Hash: 69110471700111ABCB109B18DC848A6BBADEF853A4B198575FC19CB361F723FA16C751
                                          Function 004043B0 Relevance: 6.1, APIs: 4, Instructions: 54stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: strlenstrncat
                                          • String ID:
                                          • API String ID: 3854678441-0
                                          • Opcode ID: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                          • Instruction ID: a1bd85adc18dd833a72da197840ca80eebc8a3fb90e726dddcfc8ac31c193ccc
                                          • Opcode Fuzzy Hash: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                          • Instruction Fuzzy Hash: 431154B160C7404EE710BF2DE88935FBBD0EB85358F064DAFE5C457346D27984848B96
                                          Function 04756750 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • ?fromLatin1@QString@@SA?AV1@PBDH@Z.QT5CORE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,047589BE), ref: 04756785
                                          • ??0QString@@QAE@PBVQChar@@H@Z.QT5CORE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,047589BE), ref: 047567A3
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: String@@$?fromChar@@Latin1@
                                          • String ID:
                                          • API String ID: 1935292813-0
                                          • Opcode ID: 1056a6122058aee78eb41b56557244d133b0ca69e035f8d2c0f6fa0c2b0eb562
                                          • Instruction ID: 1f4a1a6c80bc14b735bd49b4bd68fcdcf6349f867d463205a6b8f9fb4e63f910
                                          • Opcode Fuzzy Hash: 1056a6122058aee78eb41b56557244d133b0ca69e035f8d2c0f6fa0c2b0eb562
                                          • Instruction Fuzzy Hash: 1B011B35504210AFCA00DF48ED948AAB3E8FF88611F844829F99997210E635AE18DBA3
                                          Function 00402CE0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • free.MSVCRT ref: 00402D67
                                          • free.MSVCRT ref: 00402D6F
                                          • free.MSVCRT ref: 00402D77
                                            • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                          Strings
                                          • Failed to obtain/convert traceback!, xrefs: 00402D2F
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free$ByteCharMultiWide
                                          • String ID: Failed to obtain/convert traceback!
                                          • API String ID: 3219091393-982972847
                                          • Opcode ID: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                          • Instruction ID: b1da0bbaf139879325ca28b011b54c10ba95b71f8749f1078afd24c14b703eba
                                          • Opcode Fuzzy Hash: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                          • Instruction Fuzzy Hash: 380157B16097009BD700BF6A959531FFAE4AF84744F06482EF8C897381DBB898458B9A
                                          Function 0040E7F1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: wcstombs$freereallocsetlocale
                                          • String ID:
                                          • API String ID: 3931877334-0
                                          • Opcode ID: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                          • Instruction ID: d41dfc4cb9d2f32e5806314ff69e05ab86441aac7deb837ed49f13012e92ac7c
                                          • Opcode Fuzzy Hash: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                          • Instruction Fuzzy Hash: 35012971E04714DBCB109F69D44139EFBF0FF88314F12896EE499A7391D37898518B96
                                          Function 00408B57 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                            • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                          • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                          • calloc.MSVCRT ref: 00408BAA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLastcalloc
                                          • String ID: Out of memory.$win32_utils_from_utf8
                                          • API String ID: 2784544953-2800126769
                                          • Opcode ID: ec2cb1e5026d3fc4b67ab3b6410801d6944346cc6d37ed0befe9e1bdfa6c4f47
                                          • Instruction ID: fcbae36c43b134958f39cc4fef673158ef90f98619c8ac1ec6a6b109632cf1fa
                                          • Opcode Fuzzy Hash: ec2cb1e5026d3fc4b67ab3b6410801d6944346cc6d37ed0befe9e1bdfa6c4f47
                                          • Instruction Fuzzy Hash: F7F04FB01083028FD300AF25D50535AB7E0BB80354F05893EE4E85B281D779D4498B86
                                          Function 00402F90 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32 ref: 00402F98
                                            • Part of subcall function 004086F0: FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                            • Part of subcall function 004086F0: WideCharToMultiByte.KERNEL32 ref: 00408787
                                            • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Message$ByteCharErrorFormatLastMultiWide
                                          • String ID: %s%s: %s$0$Fatal error detected
                                          • API String ID: 254840284-319980707
                                          • Opcode ID: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                          • Instruction ID: 073ad40fe3aa3b4c51d3ea82456dca4d4efc994dc50aa159961d7af2ea3959c7
                                          • Opcode Fuzzy Hash: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                          • Instruction Fuzzy Hash: 3E01C0B14093419FD320AF29D58428ABBE0BF88708F01882EE4C897251DB789988CF97
                                          Function 004066E0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 14COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: calloc
                                          • String ID: 0@$Cannot allocate memory for SPLASH_STATUS.$calloc
                                          • API String ID: 2635317215-3108904453
                                          • Opcode ID: e9ae53ffb00be03242b8a08f96269f3c0e4721a38ac4aee35946d78fdc8c9888
                                          • Instruction ID: 91d9d8c6ef22e38f4f1b4844de6a5a16a8ab255c7dc3ef68476b647e8a5c5417
                                          • Opcode Fuzzy Hash: e9ae53ffb00be03242b8a08f96269f3c0e4721a38ac4aee35946d78fdc8c9888
                                          • Instruction Fuzzy Hash: 0DD012B080E3008AC300AF21C15525E7AE4AF40704F85882EE5C557280D3BDC5959B8B
                                          Function 0040DB40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON
                                          Download Yara Rule
                                          Strings
                                          • Unknown pseudo relocation bit size %d., xrefs: 0040DC4C
                                          • Unknown pseudo relocation protocol version %d., xrefs: 0040DDAD
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                          • API String ID: 0-395989641
                                          • Opcode ID: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                          • Instruction ID: 5a79fb0c569983318be0eb92f73853d4612fcc90bcd5073555eddd72529e42a9
                                          • Opcode Fuzzy Hash: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                          • Instruction Fuzzy Hash: E271B175D042058BDB00DFA9D88029ABBF1FFC4344F25857AD888A7395D738A859CB8D
                                          Function 004124C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fputwc$memset
                                          • String ID: o
                                          • API String ID: 822753988-252678980
                                          • Opcode ID: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                          • Instruction ID: 0dfbfd20a5ff8b44feb81e2e93b8d7a761d81825f22629ca31478565f12853d3
                                          • Opcode Fuzzy Hash: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                          • Instruction Fuzzy Hash: 5B61F572E002198FCB14CF68D5806DEBBF1AF48350F19816AE858EB385D374E9968B94
                                          Function 046BE450 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: malloc
                                          • String ID: J9Xi$J9d
                                          • API String ID: 2803490479-2189256431
                                          • Opcode ID: 5893cf6e49fe81d1e5066d3db1cfcac8810b55cec5139e586dd517fcaabcf599
                                          • Instruction ID: d945034267fa91cd1efa095ed368e0ba3b477e508c93a61c8c5534caaa59e16b
                                          • Opcode Fuzzy Hash: 5893cf6e49fe81d1e5066d3db1cfcac8810b55cec5139e586dd517fcaabcf599
                                          • Instruction Fuzzy Hash: 2D419D72604201AFD710DF58DC81FDAB7E8FF88320F088469F968CB261E275E9458BA1
                                          Function 047325A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON
                                          Download Yara Rule
                                          APIs
                                          • _Py_Dealloc.PYTHON3(?), ref: 04732679
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Deallocmalloc
                                          • String ID: J9d$dJ9
                                          • API String ID: 2267669106-130877107
                                          • Opcode ID: 60654e2c92fb4eecab770c4e9e526e2aad8608a93f04ca2308fe02c9235094c7
                                          • Instruction ID: bad6bea4cc2a833dbaf5b8fe178d9e8c66559550d611cdc624a253c545c95063
                                          • Opcode Fuzzy Hash: 60654e2c92fb4eecab770c4e9e526e2aad8608a93f04ca2308fe02c9235094c7
                                          • Instruction Fuzzy Hash: C931C371644205AFD710DF68DC41EE633ECEF85324F048699FD28C72A2D771EA5587A2
                                          Function 046C0710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON
                                          Download Yara Rule
                                          APIs
                                          • ??0QItemSelection@@QAE@ABVQModelIndex@@0@Z.QT5CORE(?,?), ref: 046C07A3
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Index@@0@ItemModelSelection@@malloc
                                          • String ID: J9J9
                                          • API String ID: 1134395641-2881787613
                                          • Opcode ID: 9026ac945f795ed19cbf30b070b4db7e6f53aef2c38f084f8312d7c02dbd8a19
                                          • Instruction ID: 0b252c36d48603c57f21e179f0009b75ea636c6407b48fede2f8493d64cb5de7
                                          • Opcode Fuzzy Hash: 9026ac945f795ed19cbf30b070b4db7e6f53aef2c38f084f8312d7c02dbd8a19
                                          • Instruction Fuzzy Hash: 0B2188B2344205AFD610D699AC45FFBB7ECEB84661F040079FB09D6250EA55BD09C7B2
                                          Function 046965F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 0469668A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J1
                                          • API String ID: 2610644205-2174808320
                                          • Opcode ID: 9177eea8685a54061c749759414d4e90a62e6101671113d1c9e58a5d2782bcda
                                          • Instruction ID: d6a17e830bad4b4bdfc0e6aa43917567ff30bfa48774dca1c5210a1d74b9d8db
                                          • Opcode Fuzzy Hash: 9177eea8685a54061c749759414d4e90a62e6101671113d1c9e58a5d2782bcda
                                          • Instruction Fuzzy Hash: E521A172205201AFCA10DF58EC84EAB37E9FF85224F044469F815C7350E37AEE198BA2
                                          Function 04674540 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046745D3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J1
                                          • API String ID: 2610644205-2174808320
                                          • Opcode ID: 4e74de0c18ab82cc0456e4938aa53a4ae4888b5799718a0e8056d457d429fdc7
                                          • Instruction ID: 663aeab882748f4f1793033265ea30de8274de3f384c2f70dd651895ba9376d8
                                          • Opcode Fuzzy Hash: 4e74de0c18ab82cc0456e4938aa53a4ae4888b5799718a0e8056d457d429fdc7
                                          • Instruction Fuzzy Hash: AA2153762042119FC711DF58EC44E9A37E5FF88324F058968F964CB360E679EA15CB52
                                          Function 0470E520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 0470E5B3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J1
                                          • API String ID: 2610644205-2174808320
                                          • Opcode ID: 7d2431ff2b4409994558f9f54005ba57395f349b8f1fcdbc63f8250455586cf9
                                          • Instruction ID: 2286b9cc763a5b012a6d1488f8b4911243e10d820ea00808fd3a39362d080b63
                                          • Opcode Fuzzy Hash: 7d2431ff2b4409994558f9f54005ba57395f349b8f1fcdbc63f8250455586cf9
                                          • Instruction Fuzzy Hash: E32192762002019FC701DF58EC44E9A37E5FF88324F098969F864DB350E279E915CB52
                                          Function 046D8600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046D8693
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J1
                                          • API String ID: 2610644205-2174808320
                                          • Opcode ID: 96c0c600e211ae1c90f249eae1dac482a4cc1a2b85c48ba2c211fb76dbfbfa59
                                          • Instruction ID: fc6691c73bdddf3e0648c7bb10d157028ac5972957789876bb493056e72cf25a
                                          • Opcode Fuzzy Hash: 96c0c600e211ae1c90f249eae1dac482a4cc1a2b85c48ba2c211fb76dbfbfa59
                                          • Instruction Fuzzy Hash: F2214F76605201AFCB10DF68EC44E9A37E5FF88334F048868F969C7360E639E9598B52
                                          Function 04686720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046867B3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J1
                                          • API String ID: 2610644205-2174808320
                                          • Opcode ID: 08eb378fc078db16c015ce3d6d32d3add4369748c9512d120d9b15275da9aabd
                                          • Instruction ID: c9ed152850553fd4fd9f1ef6d3ef40fc84b5830357b00e9bdcf85fb09dc941aa
                                          • Opcode Fuzzy Hash: 08eb378fc078db16c015ce3d6d32d3add4369748c9512d120d9b15275da9aabd
                                          • Instruction Fuzzy Hash: 6B2192762002019FC710DF58EC44EDA37E5FF88324F048969F869D7350E279E959CB92
                                          Function 046D6710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(00000000), ref: 046D67A3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J1
                                          • API String ID: 2610644205-2174808320
                                          • Opcode ID: 02e24ca4d03464796cffebd411c661ed3c5fb423c0397776463c984edd07594e
                                          • Instruction ID: 3f8a8b0bd582fa14c76ae1572a5b89bd94e93b6fbcc4b5fb79b38486d2cd0fa5
                                          • Opcode Fuzzy Hash: 02e24ca4d03464796cffebd411c661ed3c5fb423c0397776463c984edd07594e
                                          • Instruction Fuzzy Hash: 9A217C76604201AFC700DF6CEC44E9A37E9FF88324F088869F865C7350E239E919DB52
                                          Function 046A4560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • _Py_Dealloc.PYTHON3 ref: 046A4614
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Deallocmalloc
                                          • String ID: EJ1
                                          • API String ID: 2267669106-3528995212
                                          • Opcode ID: 12abbb3cd60d2b9b04db5cd0f139bc96b2664ef1f0f3592195fe43493d175c80
                                          • Instruction ID: 37b779dbb6c62d7235ecbbd88d7942c60eca88414758801ca8527d420286d510
                                          • Opcode Fuzzy Hash: 12abbb3cd60d2b9b04db5cd0f139bc96b2664ef1f0f3592195fe43493d175c80
                                          • Instruction Fuzzy Hash: 10218B74204201AFD744DF18E880EAA77E9FB48320F44495CF8658B3A0EBB9AD61CF52
                                          Function 046A0630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • _Py_Dealloc.PYTHON3 ref: 046A06E4
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Deallocmalloc
                                          • String ID: EJ1
                                          • API String ID: 2267669106-3528995212
                                          • Opcode ID: 8970d5a931ba6bc595387822f2d0fa26e347007b87fde835fa39a22f8f2804d0
                                          • Instruction ID: c52648a5f5d93a1e84404e9e850d9711a2036cdc20bd55c64bdeaf3ab176d113
                                          • Opcode Fuzzy Hash: 8970d5a931ba6bc595387822f2d0fa26e347007b87fde835fa39a22f8f2804d0
                                          • Instruction Fuzzy Hash: 52218B70204201AFD714EF18D890EAA7BE9FF88324F544958F866C73A0E339AD65CF52
                                          Function 046A6760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • _Py_Dealloc.PYTHON3 ref: 046A6814
                                            • Part of subcall function 04759483: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(046BB07B,00000000,0474EB18,0000000C,00000000,04758708,?,046BB07B,?), ref: 04759498
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Deallocmalloc
                                          • String ID: EJ1
                                          • API String ID: 2267669106-3528995212
                                          • Opcode ID: 4f647d4b7a77da765a57bd315635589c2786f38237cb2d797d53485f92615a2c
                                          • Instruction ID: 8c4bb538ef445ccbffe16cec6a7096fa60f810d6ae5116fc20a745abf359a58c
                                          • Opcode Fuzzy Hash: 4f647d4b7a77da765a57bd315635589c2786f38237cb2d797d53485f92615a2c
                                          • Instruction Fuzzy Hash: 08219F74104201AFD714EF18E880EAA7BE9FB48310F54495CF8A5CB3A1E379AD65CF52
                                          Function 0465E700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyBool_FromLong.PYTHON3(?,00000000,?), ref: 0465E76C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: Bool_FromLong
                                          • String ID: 1J9
                                          • API String ID: 2610644205-2407233842
                                          • Opcode ID: 580dedc5f54ef4eb33b587ed2352608a4547453d2cd5431fcf58752d3295e688
                                          • Instruction ID: 4d40dcce455ebc3d448dcb3b7d25999a361804f8c1c64ad78a197a7762335c66
                                          • Opcode Fuzzy Hash: 580dedc5f54ef4eb33b587ed2352608a4547453d2cd5431fcf58752d3295e688
                                          • Instruction Fuzzy Hash: E0118471500200AFCB11AB58EC45EDA37E5FF54725F484568F85986260E23AEA64DB52
                                          Function 04654400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • PyFloat_FromDouble.PYTHON3 ref: 0465444D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3901140311.0000000004641000.00000020.00000001.01000000.0000001F.sdmp, Offset: 04640000, based on PE: true
                                          • Associated: 00000003.00000002.3901093264.0000000004640000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901310460.000000000475B000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901412930.00000000047D5000.00000004.00000001.01000000.0000001F.sdmpDownload File
                                          • Associated: 00000003.00000002.3901489328.00000000047FF000.00000002.00000001.01000000.0000001F.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_4640000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: DoubleFloat_From
                                          • String ID: QRectF$y(self) -> float
                                          • API String ID: 329246742-1088336965
                                          • Opcode ID: 0b34c752553e6be73dcdb618d85f4366a56de96e680c222fcb3b352349439fc0
                                          • Instruction ID: 6500186a89545ef388054accdf650cbf0ddbf7c814006480169c04e31c2b0b61
                                          • Opcode Fuzzy Hash: 0b34c752553e6be73dcdb618d85f4366a56de96e680c222fcb3b352349439fc0
                                          • Instruction Fuzzy Hash: 92F0AFB0544201AFCB00EF68EC01E9A77E4FB44701F848868F899E7310E679EE59DB52
                                          Function 0040D8E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040D92F
                                          • Unknown error, xrefs: 0040D8E2
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fprintf
                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                          • API String ID: 383729395-3474627141
                                          • Opcode ID: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                          • Instruction ID: d090ae441ae7ed191b2c3bbd373a08a5730f8df06674ae97c57d609341765c89
                                          • Opcode Fuzzy Hash: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                          • Instruction Fuzzy Hash: DD01E4B0508B85DBD300AF15E48845AFFF1FF89350F82889DF5C846269CB36D8A8C74A
                                          Function 00401D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: fclose$_wfopenfreemalloc
                                          • String ID: Failed to extract %s: failed to open archive file!
                                          • API String ID: 409134274-2950503014
                                          • Opcode ID: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                          • Instruction ID: 7614606d81e887eecfecfed5343dc5ca5952679920abc2288eb417914ad53e33
                                          • Opcode Fuzzy Hash: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                          • Instruction Fuzzy Hash: 93F01DB5A043059BDB00AF35E84419AB7E1BF80318F01893EE898DB391E738D8858B86
                                          Function 00415E10 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E37
                                          • InitializeCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E74
                                          • InitializeCriticalSection.KERNEL32(?,?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E80
                                          • EnterCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415EA8
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CriticalSection$Initialize$EnterSleep
                                          • String ID:
                                          • API String ID: 1117354567-0
                                          • Opcode ID: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                          • Instruction ID: 8d4cea6e3eae5d5154d2418d5b7341923ef78fd17797a7ba2a2094ec0acf5e62
                                          • Opcode Fuzzy Hash: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                          • Instruction Fuzzy Hash: FC113771804604CBDB65AB2CE9D51EF37A4F740300F652636D445C7324E779D9C8C69E
                                          Function 0040DFE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040DFEE
                                          • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E015
                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E01C
                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E03C
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                          • String ID:
                                          • API String ID: 682475483-0
                                          • Opcode ID: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                          • Instruction ID: ec43abde3d5bb8c9cd3b17ef075de6dc33701065addaa06d31121f0b361238c5
                                          • Opcode Fuzzy Hash: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                          • Instruction Fuzzy Hash: 6FF028B55003118BD710BF79E8C890B7BF4EB04740F0505B9DD848B325E774AC19CBAA
                                          Function 00406720 Relevance: 5.0, APIs: 4, Instructions: 29COMMON
                                          Download Yara Rule
                                          APIs
                                          • free.MSVCRT(-00000004,00D20E1C,00000002), ref: 0040673C
                                          • free.MSVCRT(-00000004,00D20E1C,00000002), ref: 0040674E
                                          • free.MSVCRT(-00000004,00D20E1C,00000002), ref: 00406760
                                          • free.MSVCRT(-00000004,00D20E1C,00000002), ref: 00406768
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.3893452109.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000003.00000002.3893350154.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893588166.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893666017.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893873972.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000003.00000002.3893953082.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_400000_SecuriteInfo.jbxd
                                          Similarity
                                          • API ID: free
                                          • String ID:
                                          • API String ID: 1294909896-0
                                          • Opcode ID: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                          • Instruction ID: 7fa97c1622dad13d69692f5ac932c0fb64940c2aa2579b211d90da9c96ec3935
                                          • Opcode Fuzzy Hash: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                          • Instruction Fuzzy Hash: 34F0FEB56143004BDF20BF35B4C565A7BE4AF00748F4B087DED85AB242E738D8908B69